Release date: 2012-03-19Updated on: 2012-03-20
Affected Systems:TYPSoft FTP Server 1.10Description:--------------------------------------------------------------------------------Bugtraq id: 52554
TYPSoft FTP Server is an easy-to-use FTP service program.
The TYPSoft FTP Server has a remote buffer overflow vulnerability when processing specially crafted APPE commands. Attackers can exploit this vulnerability to execute arbitrary code.
*>
Test method:--
Open the text file Modi comm filename.txt (for example, Modi comm yyy702.txt) In VF)
Step-by-step analysis table:
Create a field (foreseeable type and length) and a long field (to be decomposed)
Creat yy612
Appe from yyy612.txt
Appe from yyy612.txt SDF
Use yy612
Appe from yyy612.txt SDF
Appe from yyy702.txt SDF
Audit Log for message: 493475bc-0a39-0040-e100-8000c00006cc
Time stamp
Status
Description
15:09:20
Success
File adapter explorer channel prom_down: Start processing: Party "", service "bs_xxxxx"
15:09:20
Success
Write to FTP server "192. x", directory "/rtxx/promotion/",-> file "prom494175bc-0a39-0040-e100-8000c00006cc.xml"
example, we hope to be useful to you:1, can only upload. Cannot download, delete, rename.Cmds_allowed=feat,rest,cwd,list,mdtm,mkd,nlst,pass,pasv,port,pwd,quit,rmd,size,stor,type,user,acct,appe,cdup, Help,mode,noop,rein,stat,stou,stru,systFor a detailed explanation of the parametersCMDS_ALLOWED=ABOR,ACCT,APPE,CWD,CDUP,DELE,HELP,LIST,MODE,MDTM,MKD,NOOP,NLST,PASS,PASV,PORT,PWD,QUIT,REIN,RETR, Rmd,rnfr,rnto,si
, delete, rename.Cmds_allowed=feat,rest,cwd,list,mdtm,mkd,nlst,pass,pasv,port,pwd,quit,rmd,size,stor,type,user,acct,appe,cdup, Help,mode,noop,rein,stat,stou,stru,systFor a detailed explanation of the parametersCMDS_ALLOWED=ABOR,ACCT,APPE,CWD,CDUP,DELE,HELP,LIST,MODE,MDTM,MKD,NOOP,NLST,PASS,PASV,PORT,PWD,QUIT,REIN,RETR, Rmd,rnfr,rnto,site,size,stor,stat,stou,stru,syst,type,userCwd-change Working Directory Ch
Vsftpd cmds_allowedCmds_allowed = Abor, CWD, list, MDTM, MKD, NLST,Pass, PASV, port, PWD, quit, RETR, RMD, RNFR,RNTO, site, size, STOR, type, user, ACCT,APPE, cdup, help, mode, Noop, rein, stat, STOU, stru, syst
Note: Do not use line breaks or spaces. Otherwise, it will be ineffective ..
# Abor-abort a File Transfer# Cwd-change working directory# Dele-delete a Remote File# List-list remote files# MDTM-return the modification time of a file# MKD-make a
an example that I hope will be useful to you:
1, can only upload. Cannot download, delete, rename.Cmds_allowed=feat,rest,cwd,list,mdtm,mkd,nlst,pass,pasv,port,pwd,quit,rmd,size,stor,type,user,acct,appe,cdup, Help,mode,noop,rein,stat,stou,stru,syst
For a detailed explanation of the parametersCMDS_ALLOWED=ABOR,ACCT,APPE,CWD,CDUP,DELE,HELP,LIST,MODE,MDTM,MKD,NOOP,NLST,PASS,PASV,PORT,PWD,QUIT,REIN,RETR, Rmd,rn
Vsftpd cmds_allowedCmds_allowed = ABOR, CWD, LIST, MDTM, MKD, NLST,PASS, PASV, PORT, PWD, QUIT, RETR, RMD, RNFR,RNTO, SITE, SIZE, STOR, TYPE, USER, ACCT,APPE, CDUP, HELP, MODE, NOOP, REIN, STAT, STOU, STRU, SYSTNote: Do not use line breaks or spaces. Otherwise, it will be ineffective ..# ABOR-abort a file transfer# CWD-change working directory# DELE-delete a remote file# LIST-list remote files# MDTM-return the modification time of a file# MKD-make a r
Author:zfive5 (Zhaozidong)
email:zfive5@yahoo.com.cn
Introduction:
A few days ago csdn a netizen sent me a short message, asked how to implement FTP breakpoint upload! Just at the beginning I was very excited to edit the code, when the more the more-suddenly realize that there is no need to do so! Just give him a demo in Telnet.
FTP protocol is not introduced, breakpoint upload mainly used the AppE instructions (FTP instructions to explain the a
data or ASCII
2. rawcommand ("PASV"); set the server to a passive receiving mode. After the PASV command is sent, the server returns its own data transmission port, waiting for the client to connect for data transmission. The returned data is in the format of "227 entering passive mode (192,168, 2, 18,118, 32)", and then the related information is included in the returned information. IP address of the FTP server: 192.168.2.18; port opened by the FTP server for data transmission: 118*256 + 32
The following is a sharing by a netizen. It is very interesting to find that the CMD Telnet operation is used here. Here, we can remotely transfer some network operations to others. What are the specific problems? Let's take a look. Introduction: a netizen sent me a short message a few days ago and asked how to implement FTP breakpoint upload! At the beginning, I was very eager to compile the code. The more I edited the code, the more I suddenly realized that this was not necessary! It will be o
Document directory
Common commands
Less common commands
Abor
Acct *
Allo
Appe
Cdup
CWD
Dele
Help
List
MDTM
MKD
Mode
NLST
Noop
Pass
PASV
Port
PWD
Quit
Rein *
Rest
RETR
RMD
RNFR
RNTO
Site *
Size
Stat
Stor
STOU
Stru
Syst
Type
User
Note that commands marked with a * are not implemented in a number of FTP servers.
Common commands
Abor-AborT a File Transfer
CWD-CHangeWOrkingDIrectory
Dele-DeleTe A Remote File
Lis
different from the normal upload, generally, you can use the STOR command to upload files. If you want to support resumable data transfer, you must run the APPE Command. In addition, you must first obtain the extent to which files are uploaded on the FTP server, this can be used to obtain the file list under a directory on the FTP server through xdir of this class, and obtain the file size. Compare it with the file to be uploaded. If the file name is
Document directory
Commands in FTP
Someone else's code was slightly modified. Boost1.50 and vs2008 can be compiled successfully.
----------- Test_ftp.cpp ---------------
// Ftp_asio.cpp: defines the entry point of the console application. //// # Include "stdafx. H "# pragma warning (Disable: 4996) # include
-----------------------------------------
FTP command
FTP HELP
214-the following commands are recognized (* =>'s unimplemented ):
CWD xcwd cdup xcup SMNT * Quit port PASV
Eprt epsv a
the server responds to 331 and requires a password, use this command to send the password to the server. After the command is sent, you will receive a 230 response, indicating that you have logged on. Please continue, or the 530 response indicates that you cannot log on.
3. Port H1, H2, H3, H4, P1, P2 Specify an IP address and local port for the data connection. The h1-h4 is the IP address of the Internet host, P1 is the high byte of the local port, and P2 is the low byte of the local port.
4.
Stor-StorE a file on the remote host
Type-set transferType
User-sendUserName
Less common commands
Acct *-sendACCOunTInformation
Appe-AppeNd to a remote file
Cdup-CWD to the parent of the current directory
Help-returnHelpOn using the server
Mode-set transferMode
Noop-do nothing
Rein *-ReinItialize the connection
Stat-return serverStatUs
STOU-StoRe a fileUNiquely
Stru-set File TransferStruCture
Syst-returnSystEm type
Abor
Syntax: Abor
part:SetLocal_enable = YesWrite_enable = YesLocal_umask = 022The preceding comment is canceled.
(2) added:Listen = Yes (FTP acts as an independent Daemon)Chroot_local_user = Yes (the user is located in his/her home directory and cannot switch to the root directory using CD)Cmds_allowed = Abor, CWD, list, MDTM, MKD, NLST, pass, PASV,Port, PWD, quit, RETR, RMD, RNFR, RNTO, site, size, STOR, type, user,Acct, APPE, cdup, help, mode, Noop, rein, stat, STO
("Permission denied.")
Return
If not Self.establish (): Return
Self.message ("OK")
f = open (NewPath, "RB")
While self.running:
Self.alive_time = Time.time ()
data = F.read (8192)
If Len (data) = = 0:break
Self.data_fd.send (data)
F.close ()
Self.data_fd.close ()
SELF.DATA_FD = 0
Self.message ("OK")
elif cmd = = "STOR" or cmd = = "AppE":
If not can_write:
Self.message ("Permission denied.")
Return
If Os.path.exists (NewPath) and not
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.