Exploitation Summary
EIP tracks 5 public exploits for CVE-2008-5405.
PoCs published by Metasploit, Encrypt3d.M!nd, SkD, including Metasploit module exploits/windows/fileformat/cain_abel_4918_rdp.
AI-analyzed exploit summary This exploit targets a stack-based buffer overflow in Cain & Abel v4.9.24 and below via a maliciously crafted RDP file. It leverages a return address overwrite to execute arbitrary shellcode when the victim opens the file in the Remote Desktop Password Decoder tool.
Description
Stack-based buffer overflow in the RDP protocol password decoder in Cain & Abel 4.9.23 and 4.9.24, and possibly earlier, allows remote attackers to execute arbitrary code via an RDP file containing a long string.
Exploits (5)
This exploit targets a stack-based buffer overflow in Cain & Abel v4.9.24 and below via a maliciously crafted RDP file. It leverages a return address overwrite to execute arbitrary shellcode when the victim opens the file in the Remote Desktop Password Decoder tool.
This exploit targets a buffer overflow vulnerability in Cain & Abel 4.9.23 by crafting a malicious .rdp file. When decoded by Cain's Remote Desktop Password Decoder, it executes shellcode to add an administrator user with a specified password.
This exploit targets a stack overflow vulnerability in Cain & Abel <= v4.9.24 by crafting a malicious .RDP file. It leverages a JMP ESP instruction in shell32.dll to redirect execution to the shellcode, which spawns a calculator (calc.exe) as a proof of concept.
This PoC demonstrates a buffer overflow in Cain & Abel v4.9.23 by crafting a malicious .rdp file with an oversized payload (8194 'A's) to overwrite SEH records, leading to a crash and potential arbitrary code execution.
This Metasploit module exploits a stack-based buffer overflow in Cain & Abel v4.9.24 and below via a maliciously crafted RDP file. It leverages SEH overwrites and a payload to achieve remote code execution when the victim opens the file in the Remote Desktop Password Decoder tool.