CVE-2001-0797
EXPLOITEDSGI IRIX - Buffer Overflow in Login via Telnet/Rlogin Arguments
Title source: llmExploitation Summary
CVE-2001-0797 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 11 public exploits from researchers including Metasploit, Marco Ivaldi, snooq, including a Metasploit module exploits/solaris/telnet/ttyprompt.
AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in System V derived /bin/login by sending a large number of arguments via dialup. It includes shellcode for Solaris SPARC systems to achieve remote code execution.
Description
Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments through services such as telnet and rlogin.
Exploits (11)
This exploit targets a buffer overflow vulnerability in System V derived /bin/login by sending a large number of arguments via dialup. It includes shellcode for Solaris SPARC systems to achieve remote code execution.
This exploit targets a buffer overflow in Solaris in.telnetd (CVE-2001-0797) to bypass authentication by manipulating the TTYPROMPT environment variable. It sends a crafted payload to execute arbitrary commands via a reverse shell or command injection.
This exploit targets a buffer overflow in the Solaris/SPARC login utility (CVE-2001-0797) via rlogin, bypassing non-executable stack protections by returning into the .bss section. It uses a crafted payload with shellcode to achieve remote command execution as root.
This exploit targets a buffer overflow in the 'login' program (CVE-2001-0797) on UNIX systems descended from System V, such as Solaris/SunOS, HP-UX, AIX, IRIX, and Unixware. It manipulates environment variables to overwrite the 'fflag' and spawn a shell as the 'bin' user, potentially allowing privilege escalation.
This exploit leverages an integer overflow in the Solaris login process by setting the TTYPROMPT environment variable and sending a malformed username to bypass authentication. It grants unauthorized access to any non-root account without requiring a password.
This exploit targets a buffer overflow in Solaris in.telnetd (CVE-2001-0797) to bypass authentication by manipulating the TTYPROMPT environment variable. It sends a crafted payload to execute arbitrary commands via a reverse shell or command injection.
This exploit targets a buffer overflow vulnerability in /bin/login on SPARC/x86 systems, allowing remote root access. It uses crafted telnet protocol negotiations and environment variables to trigger the overflow and execute shellcode.
This exploit targets a buffer overflow vulnerability in System V derived /bin/login via dialup. It sends a crafted buffer with a return address and shellcode to achieve remote code execution on vulnerable Solaris systems.
This repository contains functional exploit code for CVE-2001-0797, a buffer overflow in Solaris rlogin, along with other exploits. The code is well-documented and includes multiple variants for different architectures.
This Metasploit module exploits a buffer overflow in Solaris in.telnetd (CVE-2001-0797) to bypass authentication by sending a malformed TTYPROMPT request followed by a crafted username. It then executes a payload via command injection.
This Metasploit module exploits a buffer overflow in System V derived /bin/login by sending extraneous arguments over dialup. It targets Solaris 2.6-8 (SPARC) and delivers a shellcode payload to achieve remote code execution.