Web Application Security
Back to list
winAUTOPWN v2.8 - Released with mod_shellcode for Reverse Shell and other OS Shellcodes
Sep 28 2011 06:27AM
QUAKER DOOMER (quakerdoomer inbox lv)
This is to announce release of winAUTOPWN version 2.8
This version covers almost all remote exploits up-till September 2011 and a few older ones as well.
Also added in this release are a few ruby exploits which require 'socket' alone for interpretation. Gee-Hence,
winAUTOPWN now requires ruby installed as well, just like perl, python and php.
This version incorporates a new command-line parameters: -targetOS to allow selection of the target Operating
System. This is essential for a few exploits to work perfectly.
The List of OS and the corresponding OS codes are available and asked when winAUTOPWN OR bsdAUTOPWN
Untill the last release there was only a bind_shell TCP shellcode available in the exploits.
This release brings yet another feature which gives the freedom to choose from a variety of shellcodes.
You can now select reverse_tcp for Windows cmd and other shellcodes for Solaris, Linux, FreeBSD, etc.
This is all done by mod_shellcode which has been created and added to WINDOWS AUTOPWN and BSD
AUTOPWN as well.
mod_shellcode gets automatically invoked by WINDOWS AUTOPWN for every scripted exploit code whose
shellcode can be manually changed.
Note that there are a few exploits in a compiled binary form which lack reverse shell and other shellcode features.
mod_shellcode is available as a separate binary in the exploits/ directory for Windows, FreeBSD x86, FreeBSD
x64 and DragonFly BSD platforms (just like the main BSD AUTOPWN and other exploit binaries) and hence can
also be manually used by exploit writers and exploiters to quickly change shellcodes in their exploit files.
This version also tackles a few minor internal bugs and fixes them.
A complete list of all Exploits in winAUTOPWN is available in CHANGELOG.TXT
A complete list of User Interface changes is available in UI_CHANGES.txt
Also, in this version :
BSDAUTOPWN has been upgraded to version 1.6.
In this release you will also find pre-compiled binaries for :
DragonFly BSD x86
A complete Document explaining : How to use winAUTOPWN/bsdAUTOPWN, How to add your own exploits
using WELF, other advanced command-line options and everything else
related to WINDOWS AUTOPWN is available at the Downloads Section.
It is also available online at: http://resources.infosecinstitute.com/vulnerability-testing-winautopwn/
winAUTOPWN and bsdAUTOPWN are Security Exploitation Frameworks which act as a frontend for quick systems
vulnerability exploitation. It can also be used to test IDS/IPS.
It takes inputs like IP address, Hostname, CMS Path, etc. and does a smart multi-
threaded portscan for TCP ports 1 to 65535. Exploits capable of giving Remote Shells, which are released publicly
over the Internet by active contributors and exploit writers are constantly added to winAUTOPWN/bsdAUTOPWN.
A lot of these exploits are written in scripting languages like ruby, python, perl and php. Presence of these
language interpreters is essential for successful exploitations using winAUTOPWN/bsdAUTOPWN.
Exploits written in languages like C, Delphi, ASM, C#, Java which can be compiled are pre-compiled and added
others. On successful exploitation winAUTOPWN/bsdAUTOPWN gives a remote shell and waits for the attacker to
use the shell before trying other exploits. This way the attacker can count and check the number of exploits which
actually worked on a Target System.
A video showing winAUTOPWN in action is available here :
Daily/Weekly Snapshot/Beta Releases of bsdAUTOPWN & winAUTOPWN are always available for download from
The Latest available releases now are winAUTOPWN version 2.8 and bsdAUTOPWN version 1.6
Crafted by : Azim Poonawala (QUAKERDOOMER)
winAUTOPWN and bsdAUTOPWN are available at http://winautopwn.co.nr
Author's website : http://solidmecca.co.nr
winAUTOPWN is updated almost daily. Check the Downloads page for weekly snapshots or use the
Latest Release which can be downloaded from : http://winautopwn.co.nr
Enjoy the Release.
"winAUTOPWN - WINDOWS AUTOPWN (For The True HyperSomniac H-a-c-k-e-r-z-z-z-z-Z-Z)"
This list is sponsored by Cenzic
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now!
[ reply ]
Copyright 2010, SecurityFocus