Team W00dp3ck3r
Source-scoped identity with 1 associated PoC and 1 linked vulnerability.
Exploit catalog results
Showing 1 PoC on this page
ExploitDBEthereal 0.10.10 - 'SIP' Protocol Dissector Remote Buffer Overflow
ExploitDB exploitPublished 2005-05-31ExploitCVE-2005-14611 file
Analysis
Technical assessment
This is a remote buffer overflow exploit targeting the SIP protocol dissector in Ethereal 0.10.0 to 0.10.10. It sends a crafted SIP packet over UDP to port 5060, overflowing a buffer in the CSeq method field to overwrite a return address and execute shellcode that adds a user 'su' with password 'su'.
Backdoor review
No backdoor observed in reviewed code
The supplied C source code is a public exploit for CVE-2005-1461 that sends a crafted SIP packet to trigger a buffer overflow in Ethereal's SIP dissector. The payload executes shellcode that adds a user 'su' with password 'su' on the victim host, as described in the code comments. No concealed backdoor, deceptive payload, or operator-directed harm beyond the stated exploit behavior was observed.
Classification basis and observed behavior
Classification basis
The code constructs a malicious payload that overwrites a return address to redirect execution to embedded shellcode, which is the defining characteristic of an exploit. It does not merely detect or report a vulnerability; it actively triggers the overflow and executes attacker-supplied code.
exploits/linux/remote/1021.c:68-73exploits/linux/remote/1021.c:131-132exploits/linux/remote/1021.c:170-179Requirements
- Target must be running a vulnerable version of Ethereal (0.10.0 to 0.10.10) with the SIP dissector enabled.
exploits/linux/remote/1021.c:3 - The exploit requires the attacker to know whether the victim started tethereal with a full path or without a directory path, as this affects the pointer address used in the exploit.
exploits/linux/remote/1021.c:98-112
Observed behavior
- Constructs a SIP packet with a malformed CSeq method field that overflows a 16-byte buffer, overwriting the return address with 0xbffee240 and repairing subsequent pointers to maintain execution flow.
exploits/linux/remote/1021.c:68-73exploits/linux/remote/1021.c:163-179 - Embeds shellcode that adds a new user 'su' with password 'su' to the victim system.
exploits/linux/remote/1021.c:23exploits/linux/remote/1021.c:53-62 - Sends the crafted buffer as a UDP packet to port 5060 on the target host.
exploits/linux/remote/1021.c:185-186
Behaviors behind the backdoor verdict
Observables
- Exploit Payload
- Payload withheldThe shellcode (lines 55-62) and comments (lines 22-23, 53-54) explicitly state the payload adds a user 'su' with password 'su' on the victim host. This is the intended exploit behavior, not a hidden backdoor.
exploits/linux/remote/1021.c:22-23exploits/linux/remote/1021.c:53-62 - Exploit Mechanism
- Payload withheldThe code constructs a SIP packet with a malformed CSeq method (lines 72-73) that overflows a 16-byte buffer, overwriting the return address (line 171) to redirect execution to the shellcode.
exploits/linux/remote/1021.c:68-73exploits/linux/remote/1021.c:163-172
What the analysis did not establish
- The evidence consists solely of the exploit source code; no network capture, build environment, or target binary is provided.
- The shellcode is presented as a raw byte array without disassembly or verification of its functionality.
- The exploit relies on hardcoded memory addresses (0xbffee240, 0xbffee328, 0xbffee338) that are specific to a particular system configuration and may not work on other targets.
- Only the supplied C source file was reviewed; no external libraries, build artifacts, or network captures were examined.
- The shellcode is provided as a hex-encoded byte array and was not disassembled or executed; its behavior is taken from the author's comments.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.