rovinbhandari / ftp Goto Github PK

View Code? Open in Web Editor NEW

156.0 156.0 99.0 134 KB

Implementation of a simple FTP client and server

C 100.00%

ftp's People

Contributors

Stargazers

Watchers

Forkers

philo-ng yewenchao0102 xuqiang1015 action121 sunriseyf heavyii sklvjz hfyuan suppippo paomarra cooldarran dbase xxqcheers selnarac zhangjinde shaowei8513 zeyufeng zjliangyun xiahuixia jinrenlab shenxuedong phoenixzsun ericma2014 wdj729115299 victortowne derekzhuo 107nationalstation sanguonaigao wcmnxd2015 siyiwolf saberongo hpsprger ptqn2016 esvitech jituijiaqiezi liupeidong0620 skyformat99 zhangshaoxiao kxingyunliushui fuzhaoke zhuzhuxiaei zhubin-1987 yaochuanhua csfanli jianghuxiaofan zhuiazhui bseazeng killerwang233 excellenperson huqihong168 markfo macherie keniking tianguochun weizengke pigloverabbit520 vacantlot progray markyangup rouchie zzu-andrew wangforsearch li-siyuan zcl158 gczhcm ljdog wzugang m-yf swingdog mhaosou ftd-fly jorinzou jjjazzer pengtao157 wahkwan ctyb anchor037 jys0305 leonardo-dong megadl cishudian bingo787 yeli95 chenhaoying zhoulunhao lxmlx lyh10 hecola andeye-sz cutegugu runningfatty swenlon stiflerstar chencai01 zengtiejiang warrior8201 123130 chm924281212

ftp's Issues

有一句话错了！导致客户端会崩溃

在命令字符串解析函数中，struct command* userinputtocommand(char s[LENUSERINPUT])，for语句语法错误！这个错编译器不会报错，找了好久终于找到了。
另：我把它改了改，可以在win下运行啦

How to reproduce

Using the prepared patch file reproduce.patch for better illustration.

patch -p1 < reproduce.patch

Compile

make

Start the server

./bin/server/server_ftp.out

Start the client to establish the connection and exit immediately

timeout 1s ./bin/client/client_ftp.out

Then, the server will crash with AddressSanitizer report:

=================================================================
==1199805==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 512 byte(s) in 1 object(s) allocated from:
    #0 0x55ec05154f7e in __interceptor_malloc (/root/projects/FTP/bin/server/server_ftp.out+0xa6f7e) (BuildId: 66b4d91f9c39c73e3399c16f9d667ddf369a1250)
    #1 0x55ec05192071 in serve_client /root/projects/FTP/server_ftp.c:53:41
    #2 0x55ec05191e28 in main /root/projects/FTP/server_ftp.c:40:2
    #3 0x7f6b1e895d09 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x23d09) (BuildId: b503275bf9fee51581fdceef97533b194035b4f7)

Direct leak of 8 byte(s) in 1 object(s) allocated from:
    #0 0x55ec05154f7e in __interceptor_malloc (/root/projects/FTP/bin/server/server_ftp.out+0xa6f7e) (BuildId: 66b4d91f9c39c73e3399c16f9d667ddf369a1250)
    #1 0x55ec0518f917 in client_info_alloc /root/projects/FTP/server_ftp_functions.c:7:49
    #2 0x55ec05191e15 in main /root/projects/FTP/server_ftp.c:39:27
    #3 0x7f6b1e895d09 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x23d09) (BuildId: b503275bf9fee51581fdceef97533b194035b4f7)

SUMMARY: AddressSanitizer: 520 byte(s) leaked in 2 allocation(s).

Bug analysis

The server use function serve_client to handle each connection from the client:

FTP/server_ftp.c

Lines 32 to 41 in 96c1a35

 while(1) 

 { 

 if((x = sfd_client = accept(sfd_server, (struct sockaddr*) &sin_client, &size_sockaddr)) < 0) 

 er("accept()", x); 

 printf(ID "Communication started with %s:%d\n", inet_ntoa(sin_client.sin_addr), ntohs(sin_client.sin_port)); 

 fflush(stdout); 

 struct client_info* ci = client_info_alloc(sfd_client, connection_id++); 

 serve_client(ci); 

 }

In the function serve_client, the memory allocated via malloc is never freed, causing memory leak.

FTP/server_ftp.c

Line 53 in 96c1a35

struct packet* data = (struct packet*) malloc(size_packet);

This bug can cause denial-of-service.

need to free memory

struct command* cmd = (struct command*) malloc(sizeof(struct command));

when use malloc, we should use free, and also should free npaths

`get` command creates non-existent files

How to reproduce

Compile using make
Start the server: ./bin/server/server_ftp.out
Start the client: ./bin/client/client_ftp.out
Type command on the client side
4.1 First list the existing file in the project

CLIENT=> FTP Client started up. Attempting communication with server @ 127.0.0.1:8487...

        > ls
        FILE:   Makefile
        FILE:   TODO
        DIR:    .git
        FILE:   client_ftp_functions.c
        FILE:   server_ftp_functions.c
        DIR:    ..
        FILE:   client_ftp.h
        FILE:   commons.c
        FILE:   file_transfer_functions.c
        FILE:   server_ftp.h
        FILE:   commons.h
        FILE:   server_ftp.c
        DIR:    bin
        FILE:   README
        DIR:    .
        FILE:   .gitignore
        DIR:    obj
        FILE:   file_transfer_functions.h
        FILE:   .vimrc.custom.FTP
        FILE:   client_ftp.c

4.2 Then try to get a file that does not exist (file_not_exist)

        > get file_not_exist
        File found; processing
        1 data packet(s) received.
        0 byte(s) written.

4.3 List the file after the get command

        > ls
        FILE:   Makefile
        FILE:   TODO
        DIR:    .git
        FILE:   client_ftp_functions.c
        FILE:   file_not_exist
        FILE:   server_ftp_functions.c
        DIR:    ..
        FILE:   client_ftp.h
        FILE:   commons.c
        FILE:   file_transfer_functions.c
        FILE:   server_ftp.h
        FILE:   commons.h
        FILE:   server_ftp.c
        DIR:    bin
        FILE:   README
        DIR:    .
        FILE:   .gitignore
        DIR:    obj
        FILE:   file_transfer_functions.h
        FILE:   .vimrc.custom.FTP
        FILE:   client_ftp.c
        >

We can see that file_not_exist is created.

Analysis

FTP/server_ftp_functions.c

Lines 51 to 69 in 96c1a35

 void command_get(struct packet* shp, struct packet* data, int sfd_client) 

 { 

 int x; 

 FILE* f = fopen(shp->buffer, "rb"); // Yo! 

 shp->type = INFO; 

 shp->comid = GET; 

 strcpy(shp->buffer, f ? "File found; processing" : "Error opening file."); 

 //printpacket(shp, HP); 

 data = htonp(shp); 

 if((x = send(sfd_client, data, size_packet, 0)) != size_packet) 

 er("send()", x); 

 if(f) 

 { 

 shp->type = DATA; 

 send_file(shp, data, sfd_client, f); 

 fclose(f); 

 } 

 send_EOT(shp, data, sfd_client); 

 }

The command_get function should first check the existence of the file to transfer.

i want help how to compile it

what the compile tutorial please ! and what the best tool for compile and build ?!

SECURITY VULNERABILITY: Directory traversal

By using the cd .. command, an attacker can traverse to the root directory, and from there into any directory the FTP server has read access to. By combining this with the get and put commands, arbitrary files can be downloaded from, or uploaded to, the target.

Memory leak

You mallocate a chunk for each request but don't free it. See below:

struct packet* data = (struct packet*) malloc(size_packet);

It never frees it though.

rovinbhandari / ftp Goto Github PK

ftp's People

Contributors

Stargazers

Watchers

Forkers

ftp's Issues

有一句话错了！导致客户端会崩溃

Denial-of-service bug

How to reproduce

Bug analysis

need to free memory

`get` command creates non-existent files

How to reproduce

Analysis

i want help how to compile it

SECURITY VULNERABILITY: Directory traversal

Memory leak

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	while(1)
	{
	if((x = sfd_client = accept(sfd_server, (struct sockaddr*) &sin_client, &size_sockaddr)) < 0)
	er("accept()", x);
	printf(ID "Communication started with %s:%d\n", inet_ntoa(sin_client.sin_addr), ntohs(sin_client.sin_port));
	fflush(stdout);

	struct client_info* ci = client_info_alloc(sfd_client, connection_id++);
	serve_client(ci);
	}

	void command_get(struct packet* shp, struct packet* data, int sfd_client)
	{
	int x;
	FILE* f = fopen(shp->buffer, "rb"); // Yo!
	shp->type = INFO;
	shp->comid = GET;
	strcpy(shp->buffer, f ? "File found; processing" : "Error opening file.");
	//printpacket(shp, HP);
	data = htonp(shp);
	if((x = send(sfd_client, data, size_packet, 0)) != size_packet)
	er("send()", x);
	if(f)
	{
	shp->type = DATA;
	send_file(shp, data, sfd_client, f);
	fclose(f);
	}
	send_EOT(shp, data, sfd_client);
	}