Bugtraq mailing list archives
Re: [Full-Disclosure] DreamFTP Server 1.02 Buffer Overflow
From: "Berend-Jan Wever" <SkyLined () edup tudelft nl>
Date: Wed, 11 Feb 2004 21:29:35 +0100
Hi all, badpack3t wasn't totally wrong when he called it a BoF because the formatstring can cause BoFs. Anyway, it's a nice little formatstring to exploit, with multiple possible attack vectors. I found it easiest to overwrite the exception handler code (since it's RWE) and then cause an exception. The exploit sends about 375 bytes to the target, which causes DreamFTP to print a string of about 4 million bytes to overwrite the SEH with the right opcodes, it then causes an exception which transfers control to the SEH which jumps to our shellcode. Attached exploit has been tested with Win2k, other windows platforms have not been tested. If it shouldn't work straight away some minor adjustments can probably fix that. (Let me know) Cheers, SkyLined ----- Original Message ----- From: "badpack3t" <badpack3t () security-protocols com> To: <full-disclosure () lists netsys com> Sent: Saturday, February 07, 2004 6:29 Subject: [Full-Disclosure] DreamFTP Server 1.02 Buffer Overflow <snip>
Exploit: Not worth the time to debug and code an exploit.
<snip> I find that hard to believe ;)
Attachment:
Nightmare.c
Description:
Current thread:
- Re: [Full-Disclosure] DreamFTP Server 1.02 Buffer Overflow Berend-Jan Wever (Feb 11)