Tag Archives: Buffer

Poison Ivy Server Buffer Overflow – Metasploit Demo

This module exploits a stack buffer overflow in Poison Ivy 2.3.2 C&C server. The exploit does not need to know the password chosen for the bot/server communication. If the C&C is configured with the default ‘admin’ password, the exploit should work fine. In case of the C&C configured with another password the exploit can fail. The ‘check’ command can be used to determine if the C&C target is using the default ‘admin’ password. Hopefully an exploit try won’t crash the Poison Ivy C&C process, just the thread responsible of handling the connection. Because of this the module provides the RANDHEADER option and a bruteforce target. If RANDHEADER is used a random header will be used. If the brute force target is selected, a random header will be sent in case the default for the password ‘admin’ doesn’t work. Bruteforce will stop after 5 tries or a session obtained.
View Source

Photodex ProShow Producer Buffer Overflow

A Local Buffer Overflow Vulnerability has been found on the Photodex ProShow Producer v5.0.3256.

When starting, the application loads the contents of the “load” file from its application directory. The application does not validate the length of the string loaded from the “load” file before passing it to a
buffer, which leads to a Buffer Overflow.

An attacker needs to force the victim to place an arbitrary “load” file into the application directory.
This vulnerability was discovered and researched by Julien Ahrens from Inshell Security.
View Source

Photodex ProShow Producer 5.0.3256 load File Handling Buffer Overflow
Exploit-DB updates
This Metasploit module exploits a stack-based buffer overflow in Photodex ProShow Producer version 5.0.3256 in the handling of the plugins load list file. An attacker must send the crafted “load” file to victim, who must store it in the installation directory. The vulnerability will be triggered the next time ProShow is opened. The module has been tested successfully on Windows XP SP3 and Windows 7 SP1.
View Source