shichenliu/ftp-server

FTP server & client based on C

FTP-server

FTP server & client based on C

Please refer to report.pdf

ftp-server's Issues

Multiple stack-based buffer overflows in connector.h

The binary is using unsafe functions like strcpy on input user data, that means, as strcpy do not properly set a maximum bytes to copy (buf size) it keeps writing user data onto the stack once the buffer has been filled, thus allowing an attacker to overwrite internal program data structures and variables and the RIP and RBP saved register, which can lead to remote code execution

Security bugs

system(cmd); on 434 and 680 lines in connector.h cause Bash Injection vulnerability.

Heap-based overflow in appendConnector @ connector.h

As the binary is using unsafe functions against the heap, an overflow is possible, allowing attackers to overwrite internal program data structures and variables and overwriting malloc metadata, which can lead to remote code execution.