CVE-2004-2271 - MiniShare 1.4.1 - BOF

References

https://nvd.nist.gov/vuln/detail/CVE-2004-2271

Vulnerability

MiniShare 1.4.1 has no bounds checking on HTTP GET requests it receives. By sending a long, malformed HTTP GET request, an attacker can perform a buffer overflow and execute arbitrary code on the system.

Exploit Notes

• Only 210 bytes of space are available for shellcode after EIP is overwritten.
  • Therefore, this exploit places the exploit shellcode into the "Host: " header of the GET request and makes use of egghunter shellcode to find the malicious shellcode in memory.