Novell eDirectory - HTTPSTK Login Stack Overflow

ExploitDBExploitDB exploitExploitEDB-10163

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Perl script that attempts to exploit a stack-based buffer overflow vulnerability (CVE-2009-4654) in Novell eDirectory 8.8 SP5 HTTPSTK. It authenticates to the target using provided credentials, then sends a POST request with overly long 'sadminpwd' and 'verifypwd' parameters (476 'A' characters) to trigger the overflow and potentially execute arbitrary code.

Backdoor review

No backdoor observed in reviewed code

The supplied Perl script is a straightforward proof-of-concept for CVE-2009-4654. It authenticates to a Novell eDirectory server and then sends a long string to trigger a stack-based buffer overflow. No backdoor, deceptive payload, or concealed malicious behavior targeting the PoC operator was observed.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesPerl
Target softwareNovell eDirectory 8.8 SP5 HTTPSTK
Attack typesStack-based Buffer Overflow
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a malicious payload (476 'A' characters) to a vulnerable parameter to trigger a stack-based buffer overflow, which is the definition of an exploit. It does not merely check for the vulnerability's existence.

exploits/windows/dos/10163.pl:53-79

Requirements

  • Target must be running Novell eDirectory 8.8 SP5 with the HTTPSTK module.exploits/windows/dos/10163.pl:1
  • Attacker must provide valid credentials (username and password) for the target.exploits/windows/dos/10163.pl:36-46

Observed behavior

  • Authenticates to the target server using a GET request to the login page and a form submission with the provided username and password.exploits/windows/dos/10163.pl:49-76
  • Sends a POST request to /dhost/httpstk;submit with 'sadminpwd' and 'verifypwd' parameters filled with 476 'A' characters to trigger a stack-based buffer overflow.exploits/windows/dos/10163.pl:53-79
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The script sends a buffer overflow payload to a remote target server.The script constructs a buffer of 476 'A' characters and sends it to the /dhost/httpstk endpoint via POST parameters sadminpwd and verifypwd. This matches the described vulnerability (CVE-2009-4654).exploits/windows/dos/10163.pl:53exploits/windows/dos/10163.pl:79
Authentication Mechanism
The script prompts the operator for a username and password to authenticate to the target server.The script reads credentials from STDIN and uses them to log in via the _LOGIN_SERVER endpoint before sending the exploit payload. This is consistent with the CVE description requiring remote authenticated users.exploits/windows/dos/10163.pl:36-46exploits/windows/dos/10163.pl:49exploits/windows/dos/10163.pl:66-75
Review boundaries

What the analysis did not establish

  • The script uses a static buffer of 476 'A' characters and does not include shellcode or a return address, which may limit its ability to achieve arbitrary code execution as described in the CVE.
  • The script relies on the WWW::Mechanize Perl module, which is not included in the evidence.
  • The evidence does not include any output or confirmation that the exploit was successful.
  • The review is based solely on the provided text of the exploit script. No external libraries (e.g., WWW::Mechanize) were inspected, and no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1