This module exploits a stack-based buffer overflow in versions 1.2 through
1.3.0 of ProFTPD server. The vulnerability is within the "sreplace" function
within the "src/support.c" file.
The off-by-one heap overflow bug in the ProFTPD sreplace function has been
discovered about 2 (two) years ago by Evgeny Legerov. We tried to exploit
this off-by-one bug via MKD command, but failed. We did not work on this bug
since then.
Actually, there are exists at least two bugs in sreplace function, one is the
mentioned off-by-one heap overflow bug the other is a stack-based buffer overflow
via 'sstrncpy(dst,src,negative argument)'.
We were unable to reach the "sreplace" stack bug on ProFTPD 1.2.10 stable
version, but the version 1.3.0rc3 introduced some interesting changes, among them:
1. another (integer) overflow in sreplace!
2. now it is possible to reach sreplace stack-based buffer overflow bug via
the "pr_display_file" function!
3. stupid '.message' file display bug
So we decided to choose ProFTPD 1.3.0 as a target for our exploit.
To reach the bug, you need to upload a specially created .message file to a
writeable directory, then do "CWD
Linux
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/linux/ftp/proftp_sreplace
msf exploit(proftp_sreplace) > show targets
...targets...
msf exploit(proftp_sreplace) > set TARGET < target-id >
msf exploit(proftp_sreplace) > show options
...show and set options...
msf exploit(proftp_sreplace) > exploit
Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.
– Jim O’Gorman | President, Offensive Security