header-logo
Suggest Exploit
vendor:
Subversion
by:
greuff
N/A
CVSS
N/A
Remote exploit against Subversion-Servers
Unknown
CWE
Product Name: Subversion
Affected Version From: Subversion 1.0.0
Affected Version To: Subversion 0.37
Patch Exists: Unknown
Related CWE:
CPE: Unknown
Metasploit:
Other Scripts:
Platforms Tested:
Unknown

hoagie_subversion.c

This is a two-stage exploit. The first stage overflows a buffer on the stack and leaves us ~60 bytes of machine code to be executed. The exploit then sends the second stage loader to the server, which can be of any length. This second stage loader spawns /bin/sh on the server and connects it to the socket-fd.

Mitigation:

Unknown
Source

Exploit-DB raw data: