Luigi Auriemma

aluigi.org (ARCHIVE-ONLY FORUM!)
It is currently 19 Jul 2012 11:51

All times are UTC [ DST ]





Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 17 posts ] 
Author Message
 Post subject: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 16 Nov 2009 05:17 

Joined: 27 Sep 2009 03:57
Posts: 8
http://milw0rm.com/exploits/6237

What does this exactly do once I've found a vulnerable server?

Thanks for the help :)


Top
 Profile  
 
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 16 Nov 2009 12:36 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
oh simple, if you find a vulnerable server contact its admin


Top
 Profile  
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 16 Nov 2009 15:21 

Joined: 24 Sep 2007 02:12
Posts: 1114
Location: http://sethioz.co.uk
no Luigi, i think he wants to know "what does this tool do?"
like what it is for. he just said that IF he is able to find a vulnerable server, then what does it do to the server.
basically he is asking the info about the tool.
...i think ?!

alos why give milw0rm link ? it is Luigi's tool..


Top
 Profile  
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 16 Nov 2009 15:56 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
ih ih ih Sethioz, mine was humour :)

the problem is in the original question which looks (ehmm "is") stupid.
if it was a question made like any rational human should do, I would have replied with:
http://aluigi.org/adv/ventrilobotomy-adv.txt


Top
 Profile  
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 16 Nov 2009 17:03 

Joined: 27 Sep 2009 03:57
Posts: 8
thanks,

I assume this vulnerability has been patched in the latest version of Ventrilo then?


Top
 Profile  
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 16 Nov 2009 17:09 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
yes, all the known server-side vulnerabilities in Ventrilo are fixed.
different situation for the client-side vulnerabilities:
http://aluigi.org/adv/ventrilomemset-adv.txt
http://aluigi.org/adv/ventspeex-adv.txt


Top
 Profile  
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 17 Nov 2009 15:27 

Joined: 24 Sep 2007 02:12
Posts: 1114
Location: http://sethioz.co.uk
i agree that it was kind a silly question and funny answer, but i tought maybe he confused you :)


Top
 Profile  
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 18 Dec 2009 19:16 

Joined: 27 Sep 2009 03:57
Posts: 8
I know I sound retarded lol, and this will probably get moved to trash but is there any guide on how to patch your Ventrilo.exe with the client - side vulnerability? (For Speex Codec Servers)

I'm having trouble with the data file maker.

Usage : mlpatch <original> <patched> <title> [comment]

What exactly is mlpatch used for?

Thanks for any help if it's supplied :)
illusive


Top
 Profile  
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 18 Dec 2009 20:57 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
the question is legit but there is no reply because I have not worked on a patch :)
mlpatch is simply a small tool which calculates the differences between 2 executables and creates a lpatch.dat file that can be used with lpatch to apply the differences (lpatch has 2 working modes: lpatch.dat and the .lpatch files).

so the first step, in your case, is fixing the bug


Top
 Profile  
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 19 Dec 2009 04:32 

Joined: 27 Sep 2009 03:57
Posts: 8
So what do I have to do to apply the patch to my ventrilo.exe to use the vulnerability? (Crash other peoples ventrilos?)


Top
 Profile  
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 19 Dec 2009 17:15 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
http://aluigi.org/poc/ventspeex.lpatch


Top
 Profile  
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 19 Dec 2009 23:09 

Joined: 27 Sep 2009 03:57
Posts: 8
I get "there are no bytes to change in the file" when I try to apply the patch...?

And thanks for the help thus far ;)


Top
 Profile  
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 19 Dec 2009 23:12 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
it means that you are not trying to patch ventrilo 3.0.5 for x86 32bits, which is the only version supported by the PoC


Top
 Profile  
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 21 Dec 2009 03:58 

Joined: 27 Sep 2009 03:57
Posts: 8
I got it to work :) thanks for the help.


Top
 Profile  
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 24 Jan 2010 18:05 

Joined: 24 Jan 2010 03:50
Posts: 15
everytime i try to patch this i do everything right until the last part where i have to select ventrilo.exe and i select ventrilo.exe and i get "permission denied"

Anyone know why?


Top
 Profile  
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 24 Jan 2010 18:36 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
possibilities:
- you are running ventrilo in that moment
- that exe is write protected


Top
 Profile  
 
 Post subject: Re: NULL Pointer (Ventrilo 3.0.2)
PostPosted: 24 Jan 2010 18:51 

Joined: 24 Jan 2010 03:50
Posts: 15
Ahh, yess I see now. I was using it while ventrilo was opened and since my computer is running Vista the PoC doesn't support my ventrilo version so all i get is "There are no bytes to change in the file."

Thank's for the help.


Top
 Profile  
 
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 17 posts ] 

All times are UTC [ DST ]


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for: