/* *----------------------------------------------------------------------- * * Servu2.c - Serv-U FTPD 2.x/3.x/4.x/5.x "MDTM" Command * Remote stack buffer overflow exploit * * Copyright (C) 2004 HUC All Rights Reserved. * * Author : lion * : lion@cnhonker.net * : http://www.cnhonker.com * Date : 2004-01-07 * Update : 2004-02-24 Who report this bug to Rhino??? Released v5.0.0.4 patched this bug. * : 2004-02-17 v7.0 Add Download url file and exec shellcode. * : 2004-02-04 v6.1 Modified to work with UNIX. * : 2004-02-01 v6.0 Change decode and target, change 'jmp(call) ebx' addr to 'pop,pop,ret' addr, can attack winXP and win2003 now. * : 2004-01-31 v5.0 Add msvcrt.dll jmp ebx addr, can use on CN/TW/EN/KR/other win2k SP4 if msvcrt.dll not changed. * : 2004-01-26 v4.2 Change attack target, 2.x to '>= 2.5i' and '<= 2.5h'. * : 2004-01-22 v4.1 Change connectback shellcode in one, change bind shellcode to rebind shellcode. * : 2004-01-13 v4.0 Can attack Serv-U 2.x. * : 2004-01-11 v3.1 Add "PORT" command, can penetrate through the firewall. (shport > 1024) * : 2004-01-09 v3.0 Put shellcode in file parameter, can attack Serv-U 4.1.0.12 * : 2004-01-08 v2.0 Add connectback shellcode. * : 2004-01-07 v1.0 Can attack Serv-U v3.0.0.16 ~ v4.1.0.11 * Tested : Windows 2000 Server EN/CN * : + Serv-U v3.0.0.16 ~ v5.0.0.3 * : + Serv-U v2.5b, v2.5e, v2.5h, v2.5i, v2.5k * : Windows XP EN/CN * : + Serv-U v4.x * Notice : *** Bug find by bkbll (bkbll@cnhonker.net) 2004-01-07 *** * : *** You need a valid account. include anonymous!!! *** * : *** This is a Public Version! *** * Complie :On Windows * : cl Servu2.c * :On UNIX * : gcc -o Servu2 Servu2.c -DUNIX * Usage :e:\>Servu2 * :Serv-U FTPD 2.x/3.x/4.x/5.x remote overflow exploit V7.0 (2004-01-07) * :Bug find by bkbll (bkbll@cnhonker.net), Code by lion (lion@cnhonker.net) * :Welcome to HUC website http://www.cnhonker.com * :Usage: Servu2 -i <ip> [Options] * : -t Show All Target Type. * : * :[Options:] * : -i Target IP Required * : -t Target Type Default: 0 * : -u FTP Username Default: ftp * : -p FTP Password Default: ftp@ftp.com * : -f Port of the FTP Server Default: 21 * : -s Port of the Shell Default: 53 * : -c Connect back IP For connectback shellcode * : -d Download the URL and Exec Start with 'http://' or 'ftp://' *------------------------------------------------------------------------ */ lion lion@cnhonker.net http://www.cnhonker.com 2004-02-28
Attachment:
Servu2.c
Description: Binary data
