IBM Informix Client SDK 3.0 - '.nfx' File Integer Overflow

ExploitDBExploitDB exploitExploitEDB-10070

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

PHP script generates a malicious .nfx file that exploits an integer overflow in IBM Informix setnet32.exe to achieve arbitrary code execution via a stack-based buffer overflow.

Backdoor review

No backdoor observed in reviewed code

The PoC is a PHP script that generates a malicious .nfx file to exploit CVE-2009-3691, a stack-based buffer overflow in IBM Informix setnet32.exe. The script constructs a payload containing shellcode that adds a user (sun/tzu) to the target Windows system. All behavior is consistent with the stated exploit objective; no concealed backdoor, unrelated payload, or operator-directed deception was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesphp
Target softwareIBM Informix Client SDK 3.0IBM Informix Connect Runtime 3.xsetnet32.exe
Attack typesinteger overflowstack-based buffer overflowarbitrary code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script generates a file containing a shellcode payload and crafted fields designed to trigger a vulnerability and execute arbitrary code, which is the definition of an exploit.

exploits/windows/remote/10070.php:2exploits/windows/remote/10070.php:24-60exploits/windows/remote/10070.php:130-150

Requirements

  • Victim must open the generated .nfx file with a vulnerable version of setnet32.exe.exploits/windows/remote/10070.php:20

Observed behavior

  • Constructs a .nfx file with a crafted HostSize value of 1517 to trigger an integer overflow.exploits/windows/remote/10070.php:130
  • Embeds a shellcode payload that adds a user 'sun' with password 'tzu' to the Windows system.exploits/windows/remote/10070.php:24-27
  • Writes the crafted exploit content to a file named '9sg.nfx'.exploits/windows/remote/10070.php:175
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Shellcode
windows/adduser shellcode from Metasploit, adds user 'sun' with password 'tzu'The embedded shellcode is the exploit payload, directly related to the stated vulnerability exploitation.exploits/windows/remote/10070.php:24-60
Exploit Mechanism
Integer overflow via HostSize field leading to stack buffer overflowThe script sets HostSize=1517 and constructs a HostList with NOP sled, shellcode, and ROP chain to hijack execution.exploits/windows/remote/10070.php:130-150
File Creation
Writes generated .nfx file to '9sg.nfx'The script outputs the crafted exploit file locally; no network exfiltration or unexpected file operations.exploits/windows/remote/10070.php:175
Review boundaries

What the analysis did not establish

  • Only the single PHP file was reviewed; no external dependencies or runtime behavior were analyzed.
  • Binary content within the shellcode was not disassembled or executed; its behavior is inferred from the Metasploit comment.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1