← Advisories

FTPShell Server 4.3 (licence key) Remote Buffer Overflow PoC

Low

Advisory ID

ZSL-2009-4903

Release Date

22 January 2009

Vendor

Codeorigin, LLC - http://www.ftpshell.com

Affected Version

4.3

CVE

CVE-2009-0349

Tested On

Microsoft Windows XP Professional SP2 (English)

Summary

FTPShell server is a windows FTP service that enables remote file downloads and uploads. It supports regular and secure FTP based on both SSL/TLS and SSH2. It is also extremely easy to configure and use.

Description

FTPShell Server 4.3 suffers from buffer overflow vulnerability that can be exploited remotely or localy. It fails to perform adequate boundry condition of the input .key file, allowing us to overwrite the EAX and EDX registers. When trying to install licence with less than 8000 bytes we get a message: "It appears that your key file is corrupt or invalid.", but when installing a licence with 8000 bytes we get a message: "Your licence key has been succesfully loaded. Please restart the program."

Note: When you restart the program, it will always crash untill you repair it or reinstall it.

(1178.1d4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=41414141 ebx=00b159c0 ecx=00b159c0 edx=41414141 esi=00b1c630 edi=00000005
eip=004039a0 esp=0012f3bc ebp=00000000 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
ftpshelldscp+0x39a0:
004039a0 ff5210          call    dword ptr [edx+10h]  ds:0023:41414151=????????

Proof of Concept

ftpshell_bof.plTXT

Disclosure Timeline

N/A

Credits

Vulnerability discovered by Gjoko Krstic

References

[1]http://www.milw0rm.com/exploits/7852

[2]http://xforce.iss.net/xforce/xfdb/48174

[3]http://www.securityfocus.com/bid/33403

[4]http://www.packetstormsecurity.org/filedesc/ftpshell-overflow.txt.html

[5]http://www.hackzone.ru/exploit/view/id/4344