X-NetStat Pro Buffer Overflow Vulnerability Allowing Arbitrary Code Execution

A local buffer overflow vulnerability has been identified in X-NetStat Pro version 5.63. This vulnerability allows local attackers to execute arbitrary code by overwriting the EIP register through a 264-byte buffer overflow. Exploitation involves injecting shellcode into memory and using an egg hunter technique to locate and execute the payload, taking advantage of the application's HTTP Client or Rules functionality.

Impact

Exploitation of this vulnerability leads to arbitrary code execution on the affected system.

Reproduction

The vulnerability can be reproduced by overwriting the EIP register with an egg hunter payload, which is then used to execute injected shellcode. This can be done by sending the crafted payload through the application's HTTP Client or by creating a new rule that triggers the execution of the shellcode.