Re: [Full-Disclosure] Windows XP SP1 - Microsoft FTP Client

From: Aaron Horst (anthrax101_at_gmail.com)
Date: 11/14/04

  • Next message: Dave Horsfall: "Re: Will you lot PISS OFF? (Re: [Full-Disclosure] OT: U.S. 2004 Election Fraud.)"
    To: phoenix <phoenix@enforce.com.br>
    Date: Sun, 14 Nov 2004 03:59:44 -0500
    
    

    Seems to be the classic buffer overflow. It's really easy to write a
    little script to take advantage of this due to the -s switch for the
    ftp program. I doubt that you could do anything remote with it though,
    if you're able to drop a random binary file on the HD and execute a
    command, there are better methods of attack. ;) If you're interested
    in learning about buffer overflows, figure out how to attack this one.
    It's really simple, and as easy as you're going to get.

    AnthraX101

    On Sat, 13 Nov 2004 19:53:18 -0200, phoenix <phoenix@enforce.com.br> wrote:
    > I was testing something on my ftp client, and I got an access violation.
    >
    > Microsoft Windows XP SP1 (BR) - Microsoft FTP Client
    >
    > --------------------------------------------------------------------------------
    > Conectado a localhost.
    > 220 Website FTP Server Ready
    > Usuário (localhost:(none)): ftp
    > 331 Anonymous login ok, send your complete email address as your password.
    > Senha:
    > 230 Anonymous access granted, restrictions apply.
    > ftp> quote dir
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAA
    > 500 DIR not understood
    > ftp>
    > ..nothing here..
    >
    > --------------------------------------------------------------------------------
    > Conectado a localhost.
    > 220 Website FTP Server Ready
    > Usuário (localhost:(none)): ftp
    > 331 Anonymous login ok, send your complete email address as your password.
    > Senha:
    > 230 Anonymous access granted, restrictions apply.
    > ftp> quote dir
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > ..CRASH..
    >
    > --------------------------------------------------------------------------------
    > Conectado a localhost.
    > 220 Website FTP Server Ready
    > Usuário (localhost:(none)): ftp
    > 331 Anonymous login ok, send your complete email address as your password.
    > Senha:
    > 230 Anonymous access granted, restrictions apply.
    > ftp> quote dir
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    > 500 DIR not understood
    > 500 DIR not understood
    > 500 DIR not understood
    > 500 DIR not understood
    > 500 DIR not understood
    > 500 DIR not understood
    > ..more and more..
    > ..will it stop?..
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html


  • Next message: Dave Horsfall: "Re: Will you lot PISS OFF? (Re: [Full-Disclosure] OT: U.S. 2004 Election Fraud.)"

    Relevant Pages

    • Re: Buffer overflow in Microsoft ftp.exe
      ... > There is a Buffer overflow in the raw quote command in the Microsoft Windows ... > server replyes. ... buffer overflow in the ftp client. ... Microsoft FTP server, the ftp client will crash ...
      (Vuln-Dev)
    • Re: Solaris 6 : ftp client core dump
      ... First of all, the thing that core dumped is your ftp client, not ... dereferencing a bad or NULL pointer than a buffer overflow (judging ... Expressed in this posting are my opinions. ... to opinions held by my employer, Sun Microsystems. ...
      (comp.security.unix)
    • [OpenPKG-SA-2003.025] OpenPKG Security Advisory (mutt)
      ... buffer overflow in IMAP client ... Dependent Packages: none ... $ ftp ftp.openpkg.org ...
      (Bugtraq)
    • twlc advisory: possible overflow in ms ftp client
      ... Subject: twlc advisory: possible overflow in ms ftp client ... Possible buffer overflow in windows ftp client... ...
      (Vuln-Dev)
    • Re: FTP from windows to z/os error code 451
      ... If you haven't deleted the target dataset on the mainframe, ... changes to the space specification may not be taking effect because FTP ... quote mode b ... quote site recfm=vbm ...
      (bit.listserv.ibm-main)