I've developed a FTP like multi-threaded server application as a target for this challenge of the month. It has been coded in c and compiled by VC++ 2008. This is a three step challenge:
Step 1- Find the correct "passphrase" format to logon to the server and get the "Access Granted" message. (You may use a debugger like Ollydbg to do Live RE for this step).
Step 2- Do vulnerability research on the server software. There is at least one exploitable bug but there could be more bugs or error conditions. Try to spot a memory corruption bug and write a denial of service exploit for it.
Step3- Convert your DoS exploit to a code execution exploit to get a connect-back shell.
If you have questions on the challenge, post them here (or to behrang AT sensepost.com)
[you should be able to run the server on just about anything - bug will be exploitable even under XP-SP*]
/behrang
This is Saurabh. Firstly, thank you for proving me something to reverse engineer. It has been a while since I last fired up a debugger so I was excited to read your post this morning.
As per my analysis, the password should be of 8 characters and fourth character should match the eighth character. For eg "sensepos". I could see buffer overflow vulnerability. When READ command is fed with a filename longer than 1999 characters, it causes the server to crash thus causing Denial of service attack. This is due to lack of boundary checks on that buffer. For example a string of 2004 characters will crash the server and the last 4 bytes will overwrite the EIP register. This can be exploited to
get a reverse shell. I will work on exploit when time permits... :-).
I enjoyed working on it. Thank you.
~Saurabh
@Behrang I had forgot that this is the type of thing people like us should be doing in our spare time.
I share the same feelings as Saurabh "It has been a while since I last fired up a debugger so I was excited to read your post this morning." And I would like to thank you for waking my mind up from a what seems like a long tantelizing sleep.
Sincerely,
Julius R. Friedman