[HUC] Serv-U FTPD 2.x/3.x/4.x/5.x "MDTM" Command Remote Exploit

From: lion (lion_at_cnhonker.net)
Date: 02/27/04

  • Next message: Carson Gaspar: "Re: Calife heap corrupt / potential local root exploit" 
    Date: Sat, 28 Feb 2004 04:02:50 +0800
To: "bugtraq" <bugtraq@securityfocus.com>

    /*
    *-----------------------------------------------------------------------
    *
    * Servu2.c - Serv-U FTPD 2.x/3.x/4.x/5.x "MDTM" Command
    * Remote stack buffer overflow exploit
    *
    * Copyright (C) 2004 HUC All Rights Reserved.
    *
    * Author : lion
    * : lion@cnhonker.net
    * : http://www.cnhonker.com
    * Date : 2004-01-07
    * Update : 2004-02-24 Who report this bug to Rhino??? Released v5.0.0.4 patched this bug.
    * : 2004-02-17 v7.0 Add Download url file and exec shellcode.
    * : 2004-02-04 v6.1 Modified to work with UNIX.
    * : 2004-02-01 v6.0 Change decode and target, change 'jmp(call) ebx' addr to 'pop,pop,ret' addr, can attack winXP and win2003 now.
    * : 2004-01-31 v5.0 Add msvcrt.dll jmp ebx addr, can use on CN/TW/EN/KR/other win2k SP4 if msvcrt.dll not changed.
    * : 2004-01-26 v4.2 Change attack target, 2.x to '>= 2.5i' and '<= 2.5h'.
    * : 2004-01-22 v4.1 Change connectback shellcode in one, change bind shellcode to rebind shellcode.
    * : 2004-01-13 v4.0 Can attack Serv-U 2.x.
    * : 2004-01-11 v3.1 Add "PORT" command, can penetrate through the firewall. (shport > 1024)
    * : 2004-01-09 v3.0 Put shellcode in file parameter, can attack Serv-U 4.1.0.12
    * : 2004-01-08 v2.0 Add connectback shellcode.
    * : 2004-01-07 v1.0 Can attack Serv-U v3.0.0.16 ~ v4.1.0.11
    * Tested : Windows 2000 Server EN/CN
    * : + Serv-U v3.0.0.16 ~ v5.0.0.3
    * : + Serv-U v2.5b, v2.5e, v2.5h, v2.5i, v2.5k
    * : Windows XP EN/CN
    * : + Serv-U v4.x
    * Notice : *** Bug find by bkbll (bkbll@cnhonker.net) 2004-01-07 ***
    * : *** You need a valid account. include anonymous!!! ***
    * : *** This is a Public Version! ***
    * Complie :On Windows
    * : cl Servu2.c
    * :On UNIX
    * : gcc -o Servu2 Servu2.c -DUNIX
    * Usage :e:\>Servu2
    * :Serv-U FTPD 2.x/3.x/4.x/5.x remote overflow exploit V7.0 (2004-01-07)
    * :Bug find by bkbll (bkbll@cnhonker.net), Code by lion (lion@cnhonker.net)
    * :Welcome to HUC website http://www.cnhonker.com
    * :Usage: Servu2 -i <ip> [Options]
    * : -t Show All Target Type.
    * :
    * :[Options:]
    * : -i Target IP Required
    * : -t Target Type Default: 0
    * : -u FTP Username Default: ftp
    * : -p FTP Password Default: ftp@ftp.com
    * : -f Port of the FTP Server Default: 21
    * : -s Port of the Shell Default: 53
    * : -c Connect back IP For connectback shellcode
    * : -d Download the URL and Exec Start with 'http://' or 'ftp://'
    *------------------------------------------------------------------------
    */
                                     

    　　　　　　　　lion
    　　　　　　　　lion@cnhonker.net
                   http://www.cnhonker.com
    　　　　　　　　　　2004-02-28

  • Next message: Carson Gaspar: "Re: Calife heap corrupt / potential local root exploit"

    Relevant Pages