Ethereal 10.x AFP Protocol Dissector Remote Format String Exploit...

hello everyone, got some questions to this code :

url: http://www.frsirt.com/exploits/20050806.xe...al-afp-fm.c.php

1. someone tested exactly this code, is working?
2. does ethereal use a custom port it´s running under *nix mashines on?
3. allready tested at my self but got this ...

***********************************************************
[*] address : 0x08765428
[*] sc address : 0x08765468 (address+64, for method 2)
[*] pops : 0
[*] shell port : 7979
[*] spoofed : yes

[*] destination : 192.168.178.20:548
[*] source : <random>:548
[*] amount : 5

[+] sending(2x packet = .): [!] could not allocate raw socket.
***********************************************************

maybe someone can help me , or put some information about this one here,

thx
gr33ts

Etherreal don't bind to a port it uses a library to read all packets ..the vuln is triggered when a special crafted packet is analysed.

i didn't tested it yet but i compiled it already
but in the commandslist is the -S function
-S <port> shellcode listening port.
so why is this function here if you don't need to bind a port??

Cause this is only the port for the connect back shell listen on if successfully exploited ...

* this exploit uses the DSI/afpovertcp(548) TCP port as a means of
* exploiting this. the port does NOT have to be open to exploit
* this as you can send spoofed packets or connect to a different
* port(explained in the next paragraph) to get the job done.
*
* ethereal may rely on the source port, if no dissector is found
* for the destination port, to decide what dissector to use on a
* packet. this means ANY destination port may be used, granted it
* has no destination port dissector. (ie. port 80 won't work, but
* port 1234 will)

This bug sucks thats all :-) Their is nothing good out anymore the last good remote vuln
was RPC dcom 2 years ago where u could hack every 3rd windows server now there ist nothing or all private not even a good kernel exploit *bla*

cheers

A bug or a vuln is never 'good', I think you are wrong here if you only want exploits for pwning foreign boxes. What you can grab here is knowledgement, enough to find own vulns, write own exploits or understand new exploit technologies.

ps: believe me that knowledgement is more powerful then any exploit can be