Buffer Overflow in Dup Scout, Disk Savvy, Sync Breeze, and Disk Pulse Enterprise Web Server

This repository contains a single Metasploit module (modules/exploits/windows/http/dupscts_bof.rb) that exploits a stack-based buffer overflow vulnerability (CVE-2017-13696) in the web interface of Dup Scout Enterprise versions up to 10.0.18 on Windows (x86). The exploit works by sending a specially crafted HTTP GET request with an overlong path to the built-in web server, triggering a buffer overflow and allowing execution of arbitrary code as NT AUTHORITY\SYSTEM. The module supports multiple specific versions of Dup Scout Enterprise, with version-specific offsets and return addresses. The payload is fully customizable via Metasploit and is delivered using an egghunter technique. The module includes automatic target detection and version checking by parsing the web interface's root page. The only network endpoint required is the root path ("/") of the target's web server. The exploit is operational and can be used to gain full SYSTEM-level access on vulnerable targets.

This repository contains a single Metasploit module targeting a buffer overflow vulnerability (CVE-2017-13696) in Disk Pulse Enterprise 9.9.16 for Windows. The exploit leverages a SEH (Structured Exception Handler) buffer overflow via a specially crafted HTTP GET request to the target's web interface. The module allows the attacker to execute arbitrary code as NT AUTHORITY\SYSTEM, providing full control over the target system. The payload is customizable using Metasploit's payload system and is encoded to avoid problematic characters. The module includes a check method to verify if the target is running the vulnerable version by inspecting the HTTP response. The main attack vector is network-based, exploiting the HTTP service (default port 80) exposed by Disk Pulse Enterprise. The code is operational and ready for use within the Metasploit framework.

This repository contains a single Metasploit module targeting a stack buffer overflow vulnerability (CVE-2017-13696) in the web login interface of Dup Scout Enterprise versions 9.9.14 and 10.0.18 on Windows. The exploit works by sending a specially crafted HTTP POST request to the '/login' endpoint, overflowing a stack buffer and executing arbitrary code as NT AUTHORITY\SYSTEM. The module includes automatic version detection by querying the root web page ('/'), and supports both manual and automatic target selection. The payload is customizable using Metasploit's payload system, allowing for reverse shells or other post-exploitation actions. The exploit is operational and has been tested on multiple Windows versions. The only file present is a Ruby script structured as a standard Metasploit exploit module.