The vulnerability lies in parsing the GET request by the web server component of Disk Pulse 9.9.16. An attacker can craft malicious GET requests and cause the SEH frame to overwrite, which will cause the attacker to gain complete access to the program's flow. The attacker will gain full access to the system with the highest level of privileges since Disk Pulse runs with Administrator rights.
Let's make use of the vulnerability and exploit the system as follows:
Merely setting the RHOST and the LPORT (Gateway port which will allow us access to the successful exploitation of the target), we ...
