#cat 28996.bin | msfvenom -p -a x86 -platform win -f py -e x86/unicode_mixed BufferRegister=EAX #Length is 352, but double it.

# You will see that arbitrary code is executed. # Click 'Save' and then in the main window Click 'Config' > 'Apache (nf)'. # Copy the contents of 'exploit.txt' # Start the program and click 'Config (Top Right With Symbol)' # Paste the contents of 'exploit.txt' into the following field: 'Editor'. # Steps to Reproduce: # Run the python exploit script, it will create a new file with the name 'exploit.txt'. # Special thanks to Deloitte Ukraine for providing few payed hours to create this exploit. # Software: XAMPP # Version: 3.2.2 / 7.2.9 (Newest version at time of writing) # Download: # Tested on: Windows 10 64bit with XAMPP 32bit. # Shellcode Author: Giuseppe D'Amore (EDB:28996) # Date. # Exploit Title: XAMPP Control Panel 3.2.2 - Buffer Overflow (SEH) (Unicode) # Exploit Author: Gionathan 'John' Reale (0-day DoS exploit), Semen Alexandrovich Lyhin (1-day fully working exploit).

Descargar xampp control panel v3.2.1