Linux vs FreeBSD ftp server ???

Ej ljudi, mogli smo i mi da napravimo neshto kao OpenHack... da podesi svako svoju makinu i da je da na testiranje :o) Mislio sam na primer da predator da nekome shell u FreeBSD i da taj neko pokusa da ugrozi predatorov jos uvek neukrotivi FreeBSD :)... Ajd ako imate vi neke ideje, ja sam vam na raspolaganju... Trenutno sam iskonfigurisao moj win2k, tako da ga dajem na "testiranje"...

p0zdrav

znam... ;) ali ne govorim o tome expl-u... a i ne radim to vise... ;>

Ja imam kuci jedan P200 .... nema nista pametno na njemu .... tako da bih mogao da se pridruzim akciji ...
L;))

Pa pazi i da imas 2.6.1 exploit(usta neverujem) :
1. moras da slomis chroot okruzenje kod mene...
2. to je skoro nemoguce na FReeBSD (ali ipak moguce)
3. te fore za razbijanje su local mada tesko ali veoma tesko mislim da mogu da se implementiraju remote...

Prema tome : mlacenje prazne slame :o)

Sto se tice mog FreeBSDa on je siguran koliko i svaki FreeBSD koji ima :
1. squid : 8080 port
2. Apache (SSL,PHP) : 80 port
3 bind 9.1.0 : 53 udp port
4.ssh2.4 : 22 port (sa www.ssh.com nekako mi je lepsi nego openSSH)
5.pgp_fingerd : 79 port (moj mali progy za pgp fingering recimp finger pgp@moj_ip dace pgp)
6.mysql na nekom portu pitaj boga...
7.proftpd 1.2.2rc1 :21 port

Istina da ima mnooogo servisa ali vecina od njh nije exploitabilna na neki laksi nacin...
Tako da ako je nekom bas stalo ono do jaja da proba nek mi se javne na ICQ dobice IP user/pass pa nek radi sta oce :o)

Ovo bi mogla da bude nova tema

gde da nadjem listu za sta se koriste prvih 1024 porta ?

---

Well known ports

Nego.. jel tebe neko ucio da na internetu (da to je ona svetska mreza) postoji nesto sto se zove search engine? Za ovakva pametna pitanja je dusu dao..

A pogledaj i /etc/services...

Gojko ja kucam edit C:\etc\services ali nista ne dobijam? U cemu je stos???
:o))

Ma...

Sad ja ispadam kao nadrndan i brecam se na sve redom. Ali ovo pitanje je toliko debilno da nisam mogao da izdrzim! I ovo je jos bila blaza varijanta, ipak sam mu dao odgovor iako nije zasluzio ni...

Nista Smiren sam..

vjerojatno si mislio na internal overflow koji se dogadja unutar glob() funkcije.....zato postoji config file u kojem mozes jasno definirati koliko momorije korisnik moze zauzeti. Ako zauzme vise, bude diskonektiran. Jesi dobio moj exploit za freebsd ?

proftpd nije tako losa ideja, ako se pravilno konfigurira. Osim toga, napraviti virtualnu particiju te staviti ftpd unutar choort() jaila i nije tako tesko ali u pitanje dolazi funkcionalnost.

---

pogledaj NetBSD na kojem je nemoguce izaci iz chroot()-anog environ-a zbog sys___getcwd() syscall-a koji prati broj "..." (trailing dots-a). Tu je jos i vn_isunder() koji se koristi u vise sistemskih poziva (syscalla) kao sto su chroot() fchroot() fchdir() koji se brine da direktori procesa nikad nebude iznad root dira.

---

Ne ne mislio sam kod proftpd-a je bio neki bug sa gomilom :
/.*/.*/.*/ ... i ono guta memoriju ko lud ;o) sa glob() bi pao ali ovaj guta memroiju...pazi cak mi se i X gasio,mp3 je usporavao ,odziv na tastaturu je bio ocajan,jedva sam ukucao killall proftpd.
U 1.2.2rc2 problem je resen sad samo diskonektuje usera koji proba taki DOS.

Imaju forice da se sa mknod() kreira device preko koga mogu da se citaju podaci.Hmmm mozda bi se mogao nekako i mountovati pa uraditi chroot() unutar tog fs-a.
Znam recimo kad kod bsd zajebem neku conf skritpicu i ocu da je ispravim moram da se dignem u signle mod :
boot -s ili da pritisnem ctrl+c kod automountovanja.
Onda kako mi je fs mountovan r na :/ -> /dev/ad0s1a ja uzmem i montiram :
/dev/ad0s1 na /mnt i izmenim sta se treba izmeniti.opalim /sbin/init 6 i promene su sacuvane.
Inace moze se chroot() na bsd slomiti na foru modula.Ceo shell code + modulce sam ti poslao ranije pod imenom crazy ;o)

mozda u /etc/services ? :)

#
# Network services, Internet style
#
# Note that it is presently the policy of IANA to assign a single well-known
# port number for both TCP and UDP; hence, most entries here have two entries
# even if the protocol doesn't support UDP operations.
# Updated from RFC 1340, ``Assigned Numbers'' (July 1992). Not all ports
# are included, only the more common ones.
#
# from: @(#)services 5.8 (Berkeley) 5/9/91
# $Id: services,v 1.9 1993/11/08 19:49:15 cgd Exp $
#
tcpmux 1/tcp # TCP port service multiplexer
echo 7/tcp
echo 7/udp
discard 9/tcp sink null
discard 9/udp sink null
systat 11/tcp users
daytime 13/tcp
daytime 13/udp
netstat 15/tcp
qotd 17/tcp quote
msp 18/tcp # message send protocol
msp 18/udp # message send protocol
chargen 19/tcp ttytst source
chargen 19/udp ttytst source
ftp-data 20/tcp # File Transfer [Default Data]
ftp-data 20/udp # File Transfer [Default Data]
ftp 21/tcp # File Transfer [Control]
ftp 21/udp # File Transfer [Control]
ssh 22/tcp # Secure Shell Login
ssh 22/udp # Secure Shell Login
telnet 23/tcp
telnet 23/udp
# 24 - private
smtp 25/tcp mail
# 26 - unassigned
time 37/tcp timserver
time 37/udp timserver
rlp 39/udp resource # resource location
nameserver 42/tcp name # IEN 116
whois 43/tcp nicname
domain 53/tcp nameserver # name-domain server
domain 53/udp nameserver
mtp 57/tcp # deprecated
bootps 67/tcp # BOOTP server
bootps 67/udp
bootpc 68/tcp # BOOTP client
bootpc 68/udp
tftp 69/udp
gopher 70/tcp # Internet Gopher
gopher 70/udp
rje 77/tcp netrjs
finger 79/tcp
www 80/tcp http # WorldWideWeb HTTP
www 80/udp # HyperText Transfer Protocol
link 87/tcp ttylink
kerberos 88/tcp krb5 # Kerberos v5
kerberos 88/udp
supdup 95/tcp
# 100 - reserved
hostnames 101/tcp hostname # usually from sri-nic
iso-tsap 102/tcp tsap # part of ISODE.
csnet-ns 105/tcp cso-ns # also used by CSO name server
csnet-ns 105/udp cso-ns
rtelnet 107/tcp # Remote Telnet
rtelnet 107/udp
pop2 109/tcp postoffice # POP version 2
pop2 109/udp
pop3 110/tcp # POP version 3
pop3 110/udp
sunrpc 111/tcp
sunrpc 111/udp
auth 113/tcp tap ident authentication
sftp 115/tcp
uucp-path 117/tcp
nntp 119/tcp readnews untp # USENET News Transfer Protocol
ntp 123/tcp
ntp 123/udp # Network Time Protocol
netbios-ns 137/tcp # NETBIOS Name Service
netbios-ns 137/udp
netbios-dgm 138/tcp # NETBIOS Datagram Service
netbios-dgm 138/udp
netbios-ssn 139/tcp # NETBIOS session service
netbios-ssn 139/udp
imap2 143/tcp # Interim Mail Access Proto v2
imap2 143/udp
snmp 161/udp # Simple Net Mgmt Proto
snmp-trap 162/udp snmptrap # Traps for SNMP
cmip-man 163/tcp # ISO mgmt over IP (CMOT)
cmip-man 163/udp
cmip-agent 164/tcp
cmip-agent 164/udp
xdmcp 177/tcp # X Display Mgr. Control Proto
xdmcp 177/udp
nextstep 178/tcp NeXTStep NextStep # NeXTStep window
nextstep 178/udp NeXTStep NextStep # server
bgp 179/tcp # Border Gateway Proto.
bgp 179/udp
prospero 191/tcp # Cliff Neuman's Prospero
prospero 191/udp
irc 194/tcp # Internet Relay Chat
irc 194/udp
smux 199/tcp # SNMP Unix Multiplexer
smux 199/udp
at-rtmp 201/tcp # AppleTalk routing
at-rtmp 201/udp
at-nbp 202/tcp # AppleTalk name binding
at-nbp 202/udp
at-echo 204/tcp # AppleTalk echo
at-echo 204/udp
at-zis 206/tcp # AppleTalk zone information
at-zis 206/udp
z3950 210/tcp wais # NISO Z39.50 database
z3950 210/udp wais
ipx 213/tcp # IPX
ipx 213/udp
imap3 220/tcp # Interactive Mail Access
imap3 220/udp # Protocol v3
ulistserv 372/tcp # UNIX Listserv
ulistserv 372/udp
#
# UNIX specific services
#
exec 512/tcp
biff 512/udp comsat
login 513/tcp
who 513/udp whod
shell 514/tcp cmd # no passwords used
syslog 514/udp
printer 515/tcp spooler # line printer spooler
talk 517/udp
ntalk 518/udp
route 520/udp router routed # RIP
timed 525/udp timeserver
tempo 526/tcp newdate
courier 530/tcp rpc
conference 531/tcp chat
netnews 532/tcp readnews
netwall 533/udp # -for emergency broadcasts
uucp 540/tcp uucpd # uucp daemon
remotefs 556/tcp rfs_server rfs # Brunhoff remote filesystem
klogin 543/tcp # Kerberized `rlogin' (v5)
kshell 544/tcp # Kerberized `rsh' (v5)
kerberos-adm 749/tcp # Kerberos `kadmin' (v5)
#
webster 765/tcp # Network dictionary
webster 765/udp
#
# From ``Assigned Numbers'':
#
#> The Registered Ports are not controlled by the IANA and on most systems
#> can be used by ordinary user processes or programs executed by ordinary
#> users.
#
#> Ports are used in the TCP [45,106] to name the ends of logical
#> connections which carry long term conversations. For the purpose of
#> providing services to unknown callers, a service contact port is
#> defined. This list specifies the port used by the server process as its
#> contact port. While the IANA can not control uses of these ports it
#> does register or list uses of these ports as a convienence to the
#> community.
#
ingreslock 1524/tcp
ingreslock 1524/udp
prospero-np 1525/tcp # Prospero non-privileged
prospero-np 1525/udp
rfe 5002/tcp # Radio Free Ethernet
rfe 5002/udp # Actually uses UDP only
#
#
# Kerberos (Project Athena/MIT) services
# Note that these are for Kerberos v4, and are unofficial. Sites running
# v4 should uncomment these and comment out the v5 entries above.
#
kerberos 750/udp kdc # Kerberos (server) udp
kerberos 750/tcp kdc # Kerberos (server) tcp
krbupdate 760/tcp kreg # Kerberos registration
kpasswd 761/tcp kpwd # Kerberos "passwd"
klogin 543/tcp # Kerberos rlogin
eklogin 2105/tcp # Kerberos encrypted rlogin
kshell 544/tcp krcmd # Kerberos remote shell
#
# Unofficial but necessary (for NetBSD) services
#
supfilesrv 871/tcp # SUP server
supfiledbg 1127/tcp # SUP debugging