bugtraq - Re: DreamFTP Server 1.02 Buffer Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <003f01c3f0dd$c44a7b00$0100a8c0@grotedoos>
Date: Wed, 11 Feb 2004 21:29:35 +0100
From: "Berend-Jan Wever" <SkyLined@...p.tudelft.nl>
To: <full-disclosure@...ts.netsys.com>, <bugtraq@...urityfocus.com>
Subject: Re: DreamFTP Server 1.02 Buffer Overflow

Hi all,

badpack3t wasn't totally wrong when he called it a BoF because the
formatstring can cause BoFs. Anyway, it's a nice little formatstring to
exploit, with multiple possible attack vectors. I found it easiest to
overwrite the exception handler code (since it's RWE) and then cause an
exception.
The exploit sends about 375 bytes to the target, which causes DreamFTP to
print a string of about 4 million bytes to overwrite the SEH with the right
opcodes, it then causes an exception which transfers control to the SEH
which jumps to our shellcode.

Attached exploit has been tested with Win2k, other windows platforms have
not been tested. If it shouldn't work straight away some minor adjustments
can probably fix that. (Let me know)

Cheers,

SkyLined

----- Original Message ----- 
From: "badpack3t" <badpack3t@...urity-protocols.com>
To: <full-disclosure@...ts.netsys.com>
Sent: Saturday, February 07, 2004 6:29
Subject: [Full-Disclosure] DreamFTP Server 1.02 Buffer Overflow

<snip>
> Exploit:
>
> Not worth the time to debug and code an exploit.
>
<snip>

I find that hard to believe ;)

Download attachment "Nightmare.c" of type "application/octet-stream" (4228 bytes)