Mailing List Archive

On Thu, Dec 13, 2001 at 03:07:29PM +0100, Michel Arboi wrote:
> Going on with my "mailbox flush". This plugin is supposed to crash
> EFTP <= 2.0.7.337
> It needs a valid account and a writable directory.
>
> I did not test it, though, so I'd appreciate comments on it.

With this kind of check, I usually prefer when there's a "failsafe"
solution. ie:

if(have_login && have_password && have_a_writeable_dir)
{
really_try_the_flaw();
}
else
{
grab_the_banner_and_do_pattern_matching()
}

Could you do that ?
-- Renaud

Renaud Deraison <deraison@cvs.nessus.org> writes:

> With this kind of check, I usually prefer when there's a "failsafe"
> solution. ie
[snip]

I suppose I also should handle the "safe check" option :-\

On Thu, Dec 13, 2001 at 03:28:49PM +0100, Michel Arboi wrote:
> Renaud Deraison <deraison@cvs.nessus.org> writes:
>
> > With this kind of check, I usually prefer when there's a "failsafe"
> > solution. ie
> [snip]
>
> I suppose I also should handle the "safe check" option :-\

Yes, but it's the same as not having a login/password/whatever.

Actually, the complete logic should be :



---
if(!safe_checks())
{
if(login && password && have_a_writeable_dir)
{
if(could_log_in)
{
# actually test for the flaw
exit(0);
}
}
}

#
# Fail-safe - pattern matching on the banner
#

banner = get_kb_item(string("ftp/", port, "/banner"));
if(!banner) ....

do_some_regexp(banner);


---

This is more fine-grained than in my previous post, as it helps to do
the test, even if something goes wrong (can't log in any more for some
reason, or ftp server went down).


-- Renaud

Hello,

I just download the EFTP product (freeware)
http://www.eftp.org/index.html

The banner for the new version is:
220 EFTP Version 2.0.8.347

Maybe, it could help you for the safe_check branch.

Georges Dagousset

----- Original Message -----
From: "Michel Arboi" <arboi@noos.fr>
To: <plugins-writers@list.nessus.org>
Sent: Thursday, December 13, 2001 3:28 PM
Subject: Re: EFTP buffer overflow


> Renaud Deraison <deraison@cvs.nessus.org> writes:
>
> > With this kind of check, I usually prefer when there's a "failsafe"
> > solution. ie
> [snip]
>
> I suppose I also should handle the "safe check" option :-\

"Georges Dagousset" <georges.dagousset@alert4web.com> writes:

> I just download the EFTP product (freeware)

I did this yesterday and grabbed. Sorry, I should have told you.
Here is a new (untested) version of the script.