karak0rsan
Source-scoped identity with 6 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 6 PoCs on this page
ExploitDBGracenote CDDBControl - ActiveX Control 'ViewProfile' Method Heap Buffer Overflow (PoC)
ExploitDB exploitPublished 2010-01-18Not analyzedUnlinked1 file
ExploitDBNovell eDirectory - HTTPSTK Login Stack Overflow
ExploitDB exploitPublished 2009-11-17ExploitCVE-2009-46541 file
Analysis
Technical assessment
The artifact is a Perl script that attempts to exploit a stack-based buffer overflow vulnerability (CVE-2009-4654) in Novell eDirectory 8.8 SP5 HTTPSTK. It authenticates to the target using provided credentials, then sends a POST request with overly long 'sadminpwd' and 'verifypwd' parameters (476 'A' characters) to trigger the overflow and potentially execute arbitrary code.
Backdoor review
No backdoor observed in reviewed code
The supplied Perl script is a straightforward proof-of-concept for CVE-2009-4654. It authenticates to a Novell eDirectory server and then sends a long string to trigger a stack-based buffer overflow. No backdoor, deceptive payload, or concealed malicious behavior targeting the PoC operator was observed.
Classification basis and observed behavior
Classification basis
The script actively sends a malicious payload (476 'A' characters) to a vulnerable parameter to trigger a stack-based buffer overflow, which is the definition of an exploit. It does not merely check for the vulnerability's existence.
exploits/windows/dos/10163.pl:53-79Requirements
- Target must be running Novell eDirectory 8.8 SP5 with the HTTPSTK module.
exploits/windows/dos/10163.pl:1 - Attacker must provide valid credentials (username and password) for the target.
exploits/windows/dos/10163.pl:36-46
Observed behavior
- Authenticates to the target server using a GET request to the login page and a form submission with the provided username and password.
exploits/windows/dos/10163.pl:49-76 - Sends a POST request to /dhost/httpstk;submit with 'sadminpwd' and 'verifypwd' parameters filled with 476 'A' characters to trigger a stack-based buffer overflow.
exploits/windows/dos/10163.pl:53-79
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe script constructs a buffer of 476 'A' characters and sends it to the /dhost/httpstk endpoint via POST parameters sadminpwd and verifypwd. This matches the described vulnerability (CVE-2009-4654).
exploits/windows/dos/10163.pl:53exploits/windows/dos/10163.pl:79 - Authentication Mechanism
- Payload withheldThe script reads credentials from STDIN and uses them to log in via the _LOGIN_SERVER endpoint before sending the exploit payload. This is consistent with the CVE description requiring remote authenticated users.
exploits/windows/dos/10163.pl:36-46exploits/windows/dos/10163.pl:49exploits/windows/dos/10163.pl:66-75
What the analysis did not establish
- The script uses a static buffer of 476 'A' characters and does not include shellcode or a return address, which may limit its ability to achieve arbitrary code execution as described in the CVE.
- The script relies on the WWW::Mechanize Perl module, which is not included in the evidence.
- The evidence does not include any output or confirmation that the exploit was successful.
- The review is based solely on the provided text of the exploit script. No external libraries (e.g., WWW::Mechanize) were inspected, and no dynamic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.