CVE-2018-6481

published 2018-02-27

CVE-2018-6481: A buffer overflow vulnerability in the control protocol of Disk Savvy Enterprise v10.4.18 allows remote attackers to execute arbitrary code by sending a…

Priority P2 73 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

A buffer overflow vulnerability in the control protocol of Disk Savvy Enterprise v10.4.18 allows remote attackers to execute arbitrary code by sending a crafted packet to TCP port 9124.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
flexense	disksavvy	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 9124↗

url http://www.disksavvy.com/setups/disksavvyent_setup_v10.4.18.exe↗

path C:\Program Files\Disk Savvy Enterprise\bin\libspp.dll↗

port 4444↗

bytes↗

\x75\x19\xba\xab\x03\x00\x00\x00\x00\x40\x00\x00

• → Exploit sends a crafted packet with a fixed 12-byte header magic (\x75\x19\xba\xab\x03\x00\x00\x00\x00\x40\x00\x00) followed by two length fields and a payload over TCP port 9124. Detect this header pattern on port 9124 traffic. ↗
• → The exploit uses a SEH overwrite with a ROP gadget at 0x10056d13 (pop ebx / pop ecx / ret 0x20) from libspp.dll, which has ASLR, Rebase, and SafeSEH all disabled. Presence of this non-ASLR DLL in the Disk Savvy Enterprise process is a prerequisite for exploitation. ↗
• → After successful exploitation, a bind shell is opened on TCP port 4444 on the victim host. Monitor for unexpected listening services on port 4444 on Windows hosts running Disk Savvy Enterprise. ↗
• → The exploit payload begins with 124 bytes of 'A' (0x41) as a buffer offset before the SEH overwrite. A large block of repeated 0x41 bytes immediately preceding the SEH chain in a TCP/9124 packet is a strong exploit indicator. ↗
• → The exploit uses 'add esp,100' (\x83\xc4\x64) repeated 20 times as a stack pivot sequence followed by 'jmp esp' (\xff\xe4). Detect this repeated byte pattern in network payloads targeting port 9124. ↗

• · The shellcode was generated with bad-character exclusions (\x00\x02\x0a\x0d\xf8\xfd). Variants of this exploit may use different shellcode but will share the same header magic and SEH overwrite structure. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119