cisco is scratchin' that part of my mind

hope somebody has an idea…..I tried to use the NTPd vulnerability on my Cisco 886VA-K9…it works…which literally means the buffer overflow crashes my router….but I'm actually not tryin' to ddos it:-)….my shell inside the packet just won't do sh*t….so what is the idea behind it ? I'm tryin' to control rsp and then execute a ROP chain to execute my code…..but –– it just keeps crashin, crashin, crashin without any code exec….has anyone tried (succesfully) foolin' around with the ntpd daemon ?:o

Its hard to say without seeing the code, but maybe try introducing a few seconds time delay incase your shell needs more time to load.

Is this the one you're referring to? https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9295

yup…that's the one…..and the router is not patchedtee-hee