McAfee ePolicy Orchestrator / ProtectionPilot Overflow

This is an exploit for the McAfee HTTP Server (NAISERV.exe). McAfee ePolicy Orchestrator 2.5.1 <= 3.5.0 and ProtectionPilot 1.1.0 are known to be vulnerable. By sending a large 'Source' header, the stack can be overwritten. This module is based on the exploit by xbxice and muts. Due to size constraints, this module uses the Egghunter technique.

Search Other Modules

Exploit Rank

• Average

Exploit Authors

• muts < muts [at] remote-exploit.org >
• xbxice < xbxice [at] yahoo.com >
• hdm < hdm [at] metasploit.com >
• patrick < patrick [at] osisecurity.com.au >

Vulnerability References

• CVE-2006-5156
• OSVDB-29421
• http://www.milw0rm.com/exploits/2467
• http://www.remote-exploit.org/advisories/mcafee-epo.pdf
• BID-20288

Exploit Targets

• 0 - ePo 2.5.1 (Service Pack 1)
• 1 - ePo 3.5.0/ProtectionPilot 1.1.0

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/windows/http/adobe_robohelper_authbypass
• exploit/windows/http/altn_securitygateway
• exploit/windows/http/altn_webadmin
• exploit/windows/http/amlibweb_webquerydll_app
• exploit/windows/http/apache_chunked
• exploit/windows/http/apache_mod_rewrite_ldap
• exploit/windows/http/apache_modjk_overflow
• exploit/windows/http/badblue_ext_overflow
• exploit/windows/http/badblue_passthru
• exploit/windows/http/bea_weblogic_jsessionid

Exploit Usage Information

Exploit Module Options