⚠️ About the vulnerability

Easy File Sharing Web Server processes HTTP POST requests directed to /sendemail.ghp as part of its email notification feature. The Email parameter accepted by this endpoint is copied into a local stack buffer without any length check.

A simplified version of the vulnerable logic looks like this:

char email_buffer[256];

strcpy(email_buffer, user_input);

Since the destination buffer has a fixed size and the input length is not validated, sending a sufficiently long string in the Email field causes the copy to write past the end of the buffer.

As more data is written, the stack layout becomes corrupted. Unlike a simple return address overwrite, the overflow reaches the Structured Exception Handler (SEH) chain stored on the stack. When an exception is triggered as a result of the corrupted stack, the OS walks the SEH chain and transfers control to the attacker-controlled handler address.

The exploitation flow therefore follows the SEH overwrite technique:

1. A long input overwrites the stack, including the nSEH and SEH handler pointers.
2. An exception is triggered due to the memory corruption.
3. The OS invokes the overwritten handler address.
4. A POP POP RETN gadget is used to transfer execution to the nSEH area.
5. A short jump forward skips over the SEH record and redirects execution to the shellcode area.
6. The shellcode runs.

This makes the vulnerability more complex to exploit than a basic EIP overwrite, but also more representative of real-world scenarios.

import socket

HOST = '127.0.0.1'
PORT = 80

request = (
	'POST /sendemail.ghp HTTP/1.1\r\n'
	'Email=' + 'A' * 5000 + '&getPassword=Get+Password'
).encode('utf-8')

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))
s.send(request)
s.close()