~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Advisory Name: Think of the buffers! Won't somebody think of the buffers?! Impact : Arbitrary code execution as SYSTEM Discovered by: Hugh Mann hughmann@xxxxxxxxxxx Tested progs : Ipswitch WS_FTP Server 4.0.2.EVAL ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Description ~~~~~~~~~~~A remote user who has write access to a directory can execute arbitrary code due to a buffer overflow in WS_FTP Server's STAT command when downloading a file the user created. This is difficult to exploit since the username would have to be pretty long. If the user has more privilege and can change its username it's easily exploited.
Details ~~~~~~~There are four types of user privileges. In order of user with highest privilege:
1. FTP System Administrator users (can change everything) 2. FTP Host Administrator users (can change everyhing on his/her FTP host) 3. Users 4. Anonymous usersOnly (1) and (2) can change a user's name. (3) would most likely have to ask (1) or (2) to change the username to a much longer name to exploit this, but if the FTP host name is really long it may not be necessary. So to be 100% sure we can exploit this, the user must be (2) because (2) can add users and change their names. A remote (1) can already execute arbitrary files.
A FTP host administrator must log in with the XAUT FTP command or he/she won't be able to use any useful SITE commands. Apparently Ipswitch thinks the "encrypted" XAUT string is much safer than plaintext USER/PASS.
The stack-based buffer overflow occurs whenever the user uploads/downloads a file and at the same time sends a STAT command (no options). The WS_FTP Server sends a 211 reply with the status of the download. This string contains the FTP host name, IP address, username, filename, and number of bytes sent/left. This is a long string (more than 200 unformatted bytes) which, with any filename and possibly a long FTP hostname / username, can overflow a 512-byte buffer on the stack. "filename" is exactly the same filename string the user asked the FTP server to send. The filename contains the shellcode and can be max 256 characters long.
Exploit ~~~~~~~ See the attached source code. _________________________________________________________________Find a broadband plan that fits. Great local deals on high-speed Internet access. http://click.atdmt.com/AVE/go/onm00200360ave/direct/01/
Attachment:
xp_ws_ftp_server.zip
Description: Zip compressed data