Re: wuftp2.4.2academ beta 12-18 exploit

From: laqat_private
Date: Fri May 07 1999 - 01:42:54 PDT
Next message: Guy Dawson: "Re: Windows NT Service Pack 5 Released"
Previous message: Glen Turner: "Re: Infosec.19990305.macof.a"
Maybe in reply to: Mixter: "wuftp2.4.2academ beta 12-18 exploit"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
On Wed, 5 May 1999 laqat_private wrote:

> > Workaround:
> >
> > wu-ftpd and variants that use files /etc/ftp* for configuration
> > can easily help protect you against the many recent variants that
> > exploit buffer overflows with MKDIR.  All the varieties I've
> > seen require creating a directory or file - that's where the
> > overflow happens.
> >
> > In /etc/ftpaccess, you have the option to specify what commands
> > may and may not be run by particular users.  Just add lines to
> > specify that user anonymous (or whatever others you want) cannot
> > put, delete, mkdir, etc.
> >
> > E.g., lines like these:
> >
> > chmod           no              anonymous
> > delete          no              anonymous
> > overwrite       no              anonymous
> > rename          no              anonymous
> > mkdir           no              anonymous
> > upload          no              anonymous
>
> if you still want to let anonymous users create directories,
> take a look at path-filter option for that very same file.
>
> # path-filter...
> path-filter  anonymous  /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-
>
> when i tried the exploit on myself i got alot of "Permission denied (pathname)",
> so at least it seems to work.
>

i got some questions about how to make this filter apply to ordinary users as
well, i might point this out at the list instead of answering each mail.

instead of anonymous, use "real" to make the filter apply to any other user.
just like:

path-filter  real  /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-

but this would piss users of as they wouldnt be allowed to create .directory
which they actually might want to do, and have the right to do.

so here is a cut from my own ftpaccess file:

# path-filter...
path-filter  anonymous  /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-
path-filter  guest      /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-
path-filter  real      /etc/pathmsg  ^[-A-Za-z0-9_\.]*$

this lets your ordinary users use filenames starting with . and -
but still rejects the exploit, lookie here:



Iюи¬яяя: Permission denied. (Filename (accept))
550 1A1U°Iю1A°Iю1A1U°.IюлO1A1Й^°'ю^юЕ±нIю1Aю^°=Iю1A»OСюячU1Й±VIюcd /; uname -a;
pwd; id;
юЖащ^°=ю^Iю1AюFююF
                  °
                   юуююV
                        Iюи¬яяя: No such file or directory.
257 "/tmp/bin" new directory created.
250 CWD command successful.
257 "/tmp/bin/sh" new directory created.
250 CWD command successful.
550-I don't like crappy filenames..
550-please choose another name for the
550-shit you're trying to send me.
550-
550-Rules:
550-1. only chars A-Z,a-z,0-9,.\- are allowed in filenames
550-2. NO initial . or - in filenames
550
"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї":
Permission denied. (Filename (accept))
550
"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї":
No such file or directory.
550-I don't like crappy filenames..
550-please choose another name for the
550-shit you're trying to send me.
550-
550-Rules:
550-1. only chars A-Z,a-z,0-9,.\- are allowed in filenames
550-2. NO initial . or - in filenames
550
яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї:
Permission denied. (Filename (accept))
550
яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї:
No such file or directory.
550-I don't like crappy filenames..
550-please choose another name for the
550-shit you're trying to send me.
550-
550-Rules:
550-1. only chars A-Z,a-z,0-9,.\- are allowed in filenames
550-2. NO initial . or - in filenames
550
"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї":
Permission denied. (Filename (accept))
550
"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї":
No such file or directory.
550-I don't like crappy filenames..
550-please choose another name for the
550-shit you're trying to send me.
550-
550-Rules:
550-1. only chars A-Z,a-z,0-9,.\- are allowed in filenames
550-2. NO initial . or - in filenames
550
яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї:
Permission denied. (Filename (accept))
550
яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї"яї:
No such file or directory.
500 'CD /; uname -a; pwd; id;': command not understood.




oh, btw, if you want to reply to me, remove the last x from my address, i put it
there to hopefully not have to get all those "out of office" messages.



-------------------------------------------
PGP : http://home.swipnet.se/laq/pgpkey.asc
HTTP: http://home.swipnet.se/laq
CELL: 070-7564423
-------------------------------------------
Next message: Guy Dawson: "Re: Windows NT Service Pack 5 Released"
Previous message: Glen Turner: "Re: Infosec.19990305.macof.a"
Maybe in reply to: Mixter: "wuftp2.4.2academ beta 12-18 exploit"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:45:18 PDT