search

straightblast / My-PoC-Exploits

PoC exploits I wrote. They're as is and I will not offer support
273 stars 62 forks source link

ARMv6 CVE-2021-21974 #6

Open shayls6 opened 2 years ago

shayls6 commented 2 years ago

Is this POC avaible for ArmV6? Because It's crashing on Client-8 service request I think 0x140 wrong on request 9 for ArmV6

[SLP Client-1] connect [SLP Client-1] directory agent advertisement [SLP Client-1] recv: b'' [SLP Client-2] connect [SLP Client-3] connect [SLP Client-4] connect [SLP Client-5] connect [SLP Client-2] service request [SLP Client-2] recv: b'\x02\x02\x00\x00\x14\x00\x00\x00\x00\x00\x00\x05\x00\x02en\x00\x05\x00\x00' [SLP Client-3] service request [SLP Client-3] recv: b'\x02\x02\x00\x00\x14\x00\x00\x00\x00\x00\x00\x05\x00\x02en\x00\x05\x00\x00' [SLP Client-4] service request [SLP Client-4] recv: b'\x02\x02\x00\x00\x14\x00\x00\x00\x00\x00\x00\x05\x00\x02en\x00\x05\x00\x00' [SLP Client-5] service request [SLP Client-5] recv: b'\x02\x02\x00\x00\x14\x00\x00\x00\x00\x00\x00\x05\x00\x02en\x00\x05\x00\x00' [SLP Client-6] connect [SLP Client-6] service request [SLP Client-6] recv: b'\x02\x02\x00\x00\x14\x00\x00\x00\x00\x00\x00\x05\x00\x02en\x00\x05\x00\x00' [SLP Client-7] connect [SLP Client-8] connect [SLP Client-6] close [SLP Client-9] connect [SLP Client-9] directory agent advertisement [SLP Client-9] recv: b'' [SLP Client-8] service request [SLP Client-8] recv: b'' [SLP Client-7] service registration [SLP Client-7] recv: b'' [SLP Client-8] service request Exception in thread Thread-8: Traceback (most recent call last): File "/usr/lib/python3.7/threading.py", line 917, in _bootstrap_inner self.run() File "CVE-2021-21974.py", line 63, in run s.send(outgoing) BrokenPipeError: [Errno 32] Broken pipe