Importing and Examining the Exploit
In this example, we’ll target Sync Breeze Enterprise
and focus on one of the two available exploits.
This will provide us with a working exploit for our target environment
and allow us to walk through the modification process.
Searching by product and version, we’ll notice that one of the available exploits
for this particular vulnerability is coded in C.
Denial of Service exploits result in a simple application crash
and no explicit exploitation path.
We should normally avoid Denial of Service exploits
whenever we have better alternatives.
Instead, let’s focus on the last two entries.
The vulnerability is present in the HTTP server module
where a buffer overflow condition is triggered on a POST request.
While we suggest reading the entire Python exploit code,
let’s discuss the core functionality of the exploit script.
At offset 780,
we overwrite the instruction pointer with a JMP ESP instruction.
Next, we prepend our shellcode with 16 NOPs.
Finally, the exploit buffer is included in the HTTP POST request and sent.
Fixing C programs requires more precautions,
as opposed to those written using Python.
We’ll demonstrate how to do this in C,
since this will provide us with useful knowledge
during a penetration test engagement.
To begin the process of modifying our exploit,
we will move the target exploit to our current working directory
using SearchSploit’s handy mirror option.
With the exploit mirrored to our home directory,
we can inspect it to determine what modifications (if any) are required
to compile the exploit to work in our target environment.
Before even considering compilation, however, we’ll notice the headers
indicating that this code was meant to be compiled on Windows:
Although we could attempt to compile this on Windows,
we will instead cross-compile this exploit using Kali.