hugsy

/**
 * FreeBSD privilege escalation CVE-2013-2171 (credits Konstantin Belousov & Alan Cox)
 *
 * tested on FreeBSD 9.1
 * ref: http://www.freebsd.org/security/advisories/FreeBSD-SA-13:06.mmap.asc
 *
 * @_hugsy_
 *
 * Syntax : 
 $ id

hugsy

#!/usr/bin/env python2

import os
import sys
import time
import subprocess

try:
    from pyvirtualdisplay import Display
except ImportError:

hugsy

import sys, time, requests, bs4

RANDOM_ID_URL = "http://www.fakenamegenerator.com/gen-random-us-us.php"

class RandomPerson:

    def __init__(self):
        self.soup = bs4.BeautifulSoup(self.get_page_text(), "lxml")
        d = self.soup.find("div", "address")
        self.firstname, self.lastname = d.h3.string.rsplit(" ", 1)

hugsy

##############################################################
#
# Universal JDWP shellifier
#
# References
# * http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp-spec.html
# * http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html
#
# Note: this script DOES NOT read output from command executed on backend. You should
#       only use it to create a reverse shell

hugsy

Even though well known methods exist to bypass ptrace deactivation on a process when spawning (fake ptrace() preloading, breakpoint on ptrace(), etc... ), it is trickier when process is already protected.

Thankfully Linux 3.2+ was generous enough to provide read/write capabilities to another process with 2 new system calls: sys_process_vm_readv and sys_process_vm_writev. (see https://github.com/torvalds/linux/blob/master/arch/x86/syscalls/syscall_64.tbl#L319)

Manual says:

These system calls transfer data between the address space of the calling

hugsy

/*
 * enferex trick to disable rand() on x64
 * @_hugsy_
 */

#include <stdlib.h>
#include <time.h>
#include <dlfcn.h>
#include <stdio.h>
#include <string.h>

hugsy

#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <stdio.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mman.h>

hugsy

/**
 * Poor version of checksec.sh script for PE (checks for ASLR, NX, Integrity, SEH flags)
 *
 * Copy/Paste commands
 * c:\> dir /s /b *.dll > DllList.txt
 * c:\> checksec.exe -f DllList.txt > DllList_checksec.txt
 *
 * @ref
 * https://msdn.microsoft.com/en-us/library/windows/desktop/ms680339(v=vs.85).aspx
 */

hugsy

#!/usr/bin/env python2
#
# OpenSSL heap overflow PoC
# Found by ZDI - ZDI-14-173 // CVE-2014-0195
# PoC by @_hugsy_
#
# Ref: https://tools.ietf.org/html/rfc6347
#

import socket, struct

hugsy

import socket
import struct
import sys

#HOST = "192.168.69.71"
HOST = "41.231.53.42"
PORT = 8282

def _s(i):
    return struct.pack("<I", i)