I am given a VM of a server running a vulnerable version of ProFTP and a attacker VM which exploits the server using an exploit provided with MetaSploit. I need to write a Snort rule to detect potential malicious attacks on the server as a part of my class assignment. Looking at the exploit code I can easily write a rule to look for the keyword SITE or \x8d\xa0\xfc\xdf\xff\xff (as my vulnerable Vm is an Ubuntu machine). However, that would be pretty lame and also writing patches specific to the code of the exploit is not a good practice. I would like the rule to apply even if the exploit code is changed.

I have read about the bug and I know that the presence of special IAC character (255 or \xFF) would potentially lead to buffer overflow. However, any normal packet could contain \xFF and writing a rule for detecting \xFF would to false positives. I want to know some specific details of the exploit which would either help me figure out where I need to look for the IAC character or help me find some details about the exploit which would allow me to find malicious packets without having to resort to look for IAC character \xFF. How do I go about doing that? Any help or pointers would be appreciated.



Currently, I have installed udcli to try to understand the commands in the ROPStack portion of the code. For ex: I am trying to evaluate line 100 (0x805a544, # mov eax,esi / pop ebx / pop esi / pop ebp / ret) in the code. I have tried:

echo "08 05 a5 44" | udcli -32 -x
echo "805a544" | udcli -32 -x
echo "44 a5 05 08" | udcli -32 -x
echo "44 a5 05 80" | udcli -32 -x

But none of them evaluates to the following sequence

mov eax,esi
pop ebx
pop esi
pop ebp
  • 4
    ProFTPD is open-source and the vulnerability is very well-documented, meaning there's no need to analyze a specific exploit. Your question would be better asked on security.stackexchange.com as writing a Snort rule does not require any reverse engineering in this context. – Jason Geffner Feb 18 '14 at 19:51
  • He clearly stated that he is studying this vulnerability as part of a class, with the intent to learn. Although his question is a bit vague, completely disregarding it because others have analyzed the exploit, is contrary to the point of stack exchange. – jbh Feb 18 '14 at 20:08
  • @jbh: Asking a question unrelated to reverse engineering is contrary to the point of the Reverse Engineering Stack Exchange :) – Jason Geffner Feb 18 '14 at 20:44
  • 1
    @TheRookierLearner: from what I see in the bug link you provided, integer underflow is triggered by buf[4102] == TELNET_IAC – qwm Feb 19 '14 at 19:29
  • 1
    '\n' means the end of src-buffer for the pr_netio_telnet_gets function. If your snort rule somehow a-priori knows the length of buffer you can skip this test by efficiency consideration, ofc – qwm Feb 19 '14 at 20:01