Vulnerability Information - EDB-ID: 48264 - CVE: N/A - Author: HODORSEC - Type: LOCAL - Platform: WINDOWS - Date: 2020-03-30 - EDB Verified: ✗ Exploit Description - Title: 10-Strike Network Inventory Explorer 9.03 - 'Read from File' Buffer Overflow (SEH) (ROP) - Description: - The vulnerability exploits the functionality to load a list of computers from a file. - Some DLLs and the main EXE don't rebase, allowing for instruction reusage for ROP. - A jump after ROP is used to go to a buffer for more space. Exploit Code Highlights - Key Offsets: - crash_esi = 2145 - crash_seh = 217 - landingpad = 310 - ROP Chain Function: - Utilizes gadgets from MSVCR71.dll, sqlite3.dll, and NetworkInventoryExplorer.exe - Includes gadgets for operations like POP EDX, RETN, MOV EAX, and function pointers adjustments - Payload Configuration: - Shellcode execution leading to opening calc.exe Additional Notes - The exploit requires disabling DEP through the ROP chain - The exploit uses NOOP sledding techniques - The payload is written to a file for execution