beckysag / ftp Goto Github PK

There are several issues with the login implementation.

1. The auth file can be downloaded, in its entirety, by anyone
2. The auth file stores passwords in plaintext for all users
3. The anonymous user is enabled by default
4. The anonymous user can download the auth file (see 1)

This means that an anonymous user, by default, can obtain and use cleartext administrator credentials for the FTP server.

The server writes directory listing results to a file tmp.txt, which is not deleted after use.

Exploitation case:
Target user target is browsing a directory and browsing around the system
Attacker, using anonymous user, waits for the target to run 'list'
Attacker uses get tmp.txt to download the directory listing and potentially learn sensitive details about the system
Target user target is unaware of attack.

first of all, I built a server through filezilla.
i tried to connect through this code, but it did not work properly.

Solution:
the char array in that code has size [512].

you shouldn't send them all.
must send only the input string.
in addition, "\r\n" must be added at the end of the command.

Original send code:
"USER MEEEE(\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0..............)"

Fix send code:
"USER MEEEE\r\n"

If you are still managing the repository, please edit it.