市面上似乎没有回显版，改了个方便使用。
webshell下只有network service和local service能够成功利用（原exp也是如此），调试无果只能作罢。
交互式登录下倒是没有什么问题，远控或是其他地方都可以用。
下载地址： 
CVE-2017-0213.rar
Github： https://github.com/zcgonvh/CVE-2017-0213
解压密码见注释。
草泥马之家
Windows与.Net.....
- 留言列表:
sm4ll
发表于 2017-09-14 12:11:50 回复- 貌似执行成功了。但是还是不行？
Building Library with path: script:C:\Windows\Temp\run.sct
Found TLB name at offset 766
QI - Marshaller: {00000000-0000-0000-C000-000000000046} 00000000000E92E0
Queried Success: 00000000000E92E0
AddRef: 1
QI - Marshaller: {0000001B-0000-0000-C000-000000000046} 00000000000E92E0
QI - Marshaller: {00000000-0000-0000-C000-000000000046} 00000000000E92E0
Queried Success: 00000000000E92E0
AddRef: 2
QI - Marshaller: {00000018-0000-0000-C000-000000000046} 00000000000E92E0
QI - Marshaller: {00000019-0000-0000-C000-000000000046} 00000000000E92E0
QI - Marshaller: {4C1E39E1-E3E3-4296-AA86-EC938D896E92} 00000000000E92E0
Release: 3
Opened Link \??\C: -˃ \Device\HarddiskVolume2\Windows\Temp: 000000000000016C
QI - Marshaller: {00000003-0000-0000-C000-000000000046} 00000000000E9820
Queried Success: 00000000000E9820
AddRef: 1
Release: 2
QI - Marshaller: {00000003-0000-0000-C000-000000000046} 00000000000E9820
Queried Success: 00000000000E9820
AddRef: 1
Marshal Interface: {00000000-0000-00
paohui
发表于 2017-07-05 22:50:44 回复- COM Aggregate Marshaler/IRemUnknown2 Type Confusion EoP (CVE-2017-0213).
Code from project-zero, mod by zcgonvh.
[+] Building Library with path: script:C:\Windows\debug\WIA\run.sct
[+] Found TLB name at offset 0x2fe
[+] Opened Link \??\C: -˃ \Device\HarddiskVolume1\Windows\debug\WIA: 000001A4
[+] wait for back connect....
[x] backdoor not connected after 5 seconds.
[+] clear all files....
大牛这是啥意思啊 webshell下whoami不返回结果 2008x64环境 network service权限
◎欢迎参与讨论，请在这里发表您的看法、交流您的观点。
- 搜索
- 最近发表
-
- DCOM Potato
- Advanced Windows TaskScheduler Playbook - Part.3 from RPC to lateral movement
- Advanced Windows Task Scheduler Playbook - Part.2 from COM to UAC bypass and get SYSTEM dirtectly
- Advanced Windows Task Scheduler Playbook - Part.1 basic
- EfsPotato
- CVE-2020-17144漏洞分析与武器化
- Windows任意文件下载的三个Tips
- CVE-2020-0688的武器化与.net反序列化漏洞那些事
- POP3 MITM思路与简单实现
- RemoteFreeLibrary
- 最新留言
-
- Now try the ysoserial.net directly, in fact, I was submitted a pull request for it a few years ago.You just need to use `ActivitySurrogateSelectorFromFile` and pass your own backdoor assembly to generate the payload, this is the large byte array named `stub` in the source.And, if the .net framework installed on the target server is updated(I forgot the exact time, maybe after 2020), the `ActivitySurrogateDisableTypeCheck` payload is also needed, this is the small byte array named `v48disablecheck` in the source.Have fun.
- Hi All.plz update code.thanks A lot.
- Hey currently in an active pentest and wanted to check out your Sharepoint CVE that just dropped. Any way to contact you and discuss?
- Hi.plz Update cve-2017-7269https://github.com/zcgonvh/cve-2017-7269-tool
- Hello first of all very thankful for your writeup and work done on the poc and rce.Wanted to ask you how did you generate the payload? where from etc.I tried generating the exact payload of your poc for example and didnt manage to get the same result or a result that worked.I need to generate my payload from zero so if you'd be able to explain how did you do that or give the source code of yours it will be very helpfulThanks alot
- I'm sorry it took me some time to find my report, I've sent you an email, please check it.
- Hi,I'am currently having some difficulty in trying to reproduce the CVE-2023-21706 and CVE-2023-21710 of yours, can you give me some hints.Nguyen
- 6
- 我收回这句话，当我没说，解压密码找到了
- 压缩包双击打开，仔细看工具栏那里，有个《注释》选项，点开里面就是解压密码，其实楼主的名字就是解压密码
- 分类归档
- RSS
-
- 联系方式
