CVE-2002-1120
Savant Web Server < 3.1 - Remote Code Execution via Long HTTP GET Request
Title source: llmExploitation Summary
EIP tracks 6 public exploits for CVE-2002-1120.
PoCs published by Metasploit, DouBle_Zer0, Jacopo Cervini, including Metasploit module exploits/windows/http/savant_31_overflow.
AI-analyzed exploit summary This is a Metasploit module exploiting a stack buffer overflow in Savant 3.1 Web Server via a malformed HTTP method. It includes a custom NOP sled generator to bypass character restrictions and targets multiple Windows versions.
Description
Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
Exploits (6)
This is a Metasploit module exploiting a stack buffer overflow in Savant 3.1 Web Server via a malformed HTTP method. It includes a custom NOP sled generator to bypass character restrictions and targets multiple Windows versions.
This exploit targets a buffer overflow vulnerability in Savant Web Server 3.1, delivering a reverse shell payload (calc.exe) via a crafted HTTP request. The exploit uses a known return address (0x00401D09) and NOP sleds to achieve reliable code execution.
This exploit targets a buffer overflow vulnerability in Savant Web Server 3.1. It sends a malicious GET request with shellcode to bind a shell on port 4444, achieving remote code execution.
This Perl script exploits a buffer overflow vulnerability in Savant web server by sending a maliciously crafted HTTP GET request followed by shellcode to achieve remote code execution. It targets Windows 2000 SP4 and Windows XP SP1 systems.
This repository contains a functional exploit for CVE-2002-1120, a stack-based buffer overflow in Savant Web Server 3.1. It includes multiple Python scripts demonstrating the exploitation process, from crash triggering to EIP control and shellcode execution using an egghunter technique.
This Metasploit module exploits a stack buffer overflow in Savant 3.1 Web Server by sending a maliciously crafted HTTP request. The exploit leverages a vulnerable HTTP method field to overwrite the return address and execute arbitrary code.