2815f48e25
12 new exploits
Linux x86_64 - Reverse Shell Shellcode
Gemalto Sentinel License Manager 18.0.1.55505 - Directory Traversal
Solarwinds Virtualization Manager - Privilege Escalation
Blat 3.2.14 - Stack Overflow
Linux/x86 - Bindshell with Configurable Port - 87 bytes
Linux x86_64 Shellcode Null-Free Reverse TCP Shell
Linux x86 TCP Bind Shell Port 4444 (656 bytes)
Tiki-Wiki CMS Calendar 14.2_ 12.5 LTS_ 9.11 LTS_ and 6.15 - Remote Code Execution
Linux/Windows/BSD x86_64 execve(_/bin//sh__ {_//bin/sh__ _-c__ _cmd_}_ NULL) Execute Command Shellcode
ATCOM PBX IP01_ IP08 _ IP4G_ IP2G4A - Authentication Bypass
Roxy Fileman 1.4.4 - Arbitrary File Upload
SlimCMS 0.1 - CSRF (Change Admin Password)
48 lines
1.3 KiB
Text
Executable file
48 lines
1.3 KiB
Text
Executable file
1. Vulnerable Product Version:
|
||
|
||
*Blat v3.2.14*
|
||
Link: blat.net
|
||
|
||
|
||
2. Vulnerability Information
|
||
|
||
Impact: Attacker may gain administrative access / can perform a DOS
|
||
|
||
Remotely Exploitable: No
|
||
|
||
Locally Exploitable: May be possible
|
||
|
||
|
||
3. Product Details
|
||
|
||
An open source Windows (32 & 64 bit) command line SMTP mailer. We can use
|
||
it to automatically email logs, the contents of a html FORM, or whatever
|
||
else you need to send.
|
||
|
||
Since blat is lightweight, user friendly and simple (but awesome) many
|
||
vendors incorporates it with their Softwares. I have seen blat in many
|
||
commercial Softwares which use it for sending mails to its customers. And
|
||
Blat is awesome.
|
||
|
||
|
||
4. Vulnerability Description
|
||
|
||
The Overflow vulnerability lies in the profile option parameter “–p”. When
|
||
a string of 236 bytes is send to blat, the EBP and EIP register gets
|
||
overwritten by the user input.
|
||
|
||
Reproduction:
|
||
|
||
* blat.exe crashes with this command blat.exe –install
|
||
smtp.my.tld 127.0.0.1 –p <”A”*234+”B”*2>*
|
||
|
||
|
||
Feeding this command overwrites EBP with 0x00410041 and EIP with 0x00420042
|
||
(Please refer to the attached screen shot)
|
||
|
||
|
||
5. Links
|
||
|
||
https://sourceforge.net/projects/blat/
|
||
|
||
https://groups.yahoo.com/neo/groups/blat/conversations/messages/13759
|