FTPShell Server 4.3 (licence key) Remote Buffer Overflow PoC
Title: FTPShell Server 4.3 (licence key) Remote Buffer Overflow PoC
Advisory ID: ZSL-2009-4903
Type: Local/Remote
Impact: System Access, DoS
Risk: (2/5)
Release Date: 22.01.2009
Note: When you restart the program, it will always crash untill you repair it or reinstall it.
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
[2] http://xforce.iss.net/xforce/xfdb/48174
[3] http://www.securityfocus.com/bid/33403
[4] http://www.packetstormsecurity.org/filedesc/ftpshell-overflow.txt.html
[5] http://www.hackzone.ru/exploit/view/id/4344
[6] http://secunia.com/advisories/33597
[7] http://securityreason.com/exploitalert/5584
[8] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0349
[9] http://osvdb.org/51510
[10] http://www.itsec.gov.cn//aqld/ldtb/3952.htm
[11] http://www.f-secure.com/vulnerabilities/en/SA200900514
[12] http://en.securitylab.ru/poc/366844.php
[12] http://www.hacker.com.cn/news/view.asp?id=2480
[13] http://www.vfocus.net/art/20090123/4522.html
[14] http://it.com.mk/index.php/Gjoko-Krstikj/Sigurnost/Slabost-kaj-FTPShell-Server-4.5-BoF
[27.01.2009] - Added reference [14]
Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2009-4903
Type: Local/Remote
Impact: System Access, DoS
Risk: (2/5)
Release Date: 22.01.2009
Summary
FTPShell server is a windows FTP service that enables remote file downloads and uploads. It supports regular and secure FTP based on both SSL/TLS and SSH2. It is also extremely easy to configure and use.Description
FTPShell Server 4.3 suffers from buffer overflow vulnerability that can be exploited remotely or localy. It fails to perform adequate boundry condition of the input .key file, allowing us to overwrite the EAX and EDX registers. When trying to install licence with less than 8000 bytes we get a message: "It appears that your key file is corrupt or invalid.", but when installing a licence with 8000 bytes we get a message: "Your licence key has been succesfully loaded. Please restart the program."Note: When you restart the program, it will always crash untill you repair it or reinstall it.
--------------------------------------------------------------------------------
(1178.1d4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=41414141 ebx=00b159c0 ecx=00b159c0 edx=41414141 esi=00b1c630 edi=00000005
eip=004039a0 esp=0012f3bc ebp=00000000 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
ftpshelldscp+0x39a0:
004039a0 ff5210 call dword ptr [edx+10h] ds:0023:41414151=????????
--------------------------------------------------------------------------------
Vendor
Codeorigin, LLC - http://www.ftpshell.comAffected Version
4.3Tested On
Microsoft Windows XP Professional SP2 (English)Vendor Status
N/APoC
ftpshell_bof.plCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] http://www.milw0rm.com/exploits/7852[2] http://xforce.iss.net/xforce/xfdb/48174
[3] http://www.securityfocus.com/bid/33403
[4] http://www.packetstormsecurity.org/filedesc/ftpshell-overflow.txt.html
[5] http://www.hackzone.ru/exploit/view/id/4344
[6] http://secunia.com/advisories/33597
[7] http://securityreason.com/exploitalert/5584
[8] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0349
[9] http://osvdb.org/51510
[10] http://www.itsec.gov.cn//aqld/ldtb/3952.htm
[11] http://www.f-secure.com/vulnerabilities/en/SA200900514
[12] http://en.securitylab.ru/poc/366844.php
[12] http://www.hacker.com.cn/news/view.asp?id=2480
[13] http://www.vfocus.net/art/20090123/4522.html
[14] http://it.com.mk/index.php/Gjoko-Krstikj/Sigurnost/Slabost-kaj-FTPShell-Server-4.5-BoF
Changelog
[22.01.2009] - Initial release[27.01.2009] - Added reference [14]
Contact
Zero Science LabWeb: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
