You are here: hacking technology > System crack > Content
Hot Articles
Recommend Articles
New Articles
Freefloat FTP Server overflow vulnerability analysis
  Add date: 03/17/2011   Publishing date: 03/17/2011   Hits: 37

In revc function fluctuation broken, gradually track and analyze down, come to:

 

00401DE0 > / $56 ESI shall

00401DE1 |. 8BF1 MOV ESI, ECX

00401DE3 |. 00040000 MOV ECX, 400 B9

00401DE8 |. 6A 00 shall 0; / Flags = 0

00401DEA |. 8B46 18 MOV EAX and dwords ESI theptr DS: [18]; + |

00401DED |. 8B56 14 MOV EDX, dwords ESI theptr DS: [+ 14]; |

00401DF0 |. ECX, 2BC8 SUB EAX; |

00401DF2 |. 03D0 ADD EDX, EAX; |

00401DF4 |. 8B06 MOV EAX and dwords ESI] [theptr DS:; |

00401DF6 |. 51 ECX shall; | BufSize = 400 (1024.)

00401DF7 |. 52 EDX shall; | 013C1820 Buffer =

00401DF8 |. 50 EAX shall; | Socket

00401DF9 |. 6E190000 e8's JMP. & WS2_32 CALL < >; j # 16 \ recv

00401DFE |. 85C0 TEST EAX and EAX; Judge whether the bytes received for empty

00401E00 |. FTPServe. JE 74 14 without 00401E16

00401E02 |. 83F8 FF CMP EAX and - 1; Determine whether receiving failure

00401E05 |. JE 0F FTPServe. 74 without 00401E16

00401E07 |. 8B4E 18 MOV ECX, dwords ESI theptr DS: [18]; + Ecx = 0

00401E0A |. ECX, 03C8 ADD EAX; Ecx = eax = receive bytes

00401E0C |. 01000000 MOV EAX and 1 B8

 

00401E11 |. 894E 18 MOV dwords theptr DS: [18], ECX ESI +

00401E14 |. 5E POP ESI


Prev:I can with Apache endeavor command access control bypass loophole Next:DiY - brief loophole analysis

Comment:

Category: Home > System crack