6

I would like to fuzz FTP protocol, and currently I have the following:

 s_read_packet();
 s_string("USER test\r\n");
 s_read_packet();
 s_string("PASS test\r\n");
 s_read_packet();

I've also tried with s_readline(); The problem is that I'm getting what's shown in the following picture:

wrong FTP packet

I should be getting what's on following two pictures: Right FTP USER command Right FTP PASS command

It looks like the SPIKE doesn't know about "\r\n" characters. Any ideas on this, why isn't it parsing the CRLF characters correctly?

Improve this question
1
  • I found it unclear what you want to be different. Is it that you want SPIKE to split the USER and PASS commands into two different packets, rather than merging them into a single packet? If so, why? Does that affect the behavior of the FTP server you are testing? (I would not expect it to make a difference, but maybe I've missed something?)
    – D.W.
    Commented Apr 14, 2012 at 2:50

2 Answers 2

Reset to default
4

When writting my response to you, I remembered what might be the problem and I've tested it and bingo - that's exactly what's wrong.

The problem isn't with a script, but with a generic_send_tcp - this is not acting as it should. If I use the following command line:

line_send_tcp 10.1.1.169 21 ftp.spk 0

instead of

generic_send_tcp 10.1.1.169 21 ftp.spk 0

everything works. So that's it. Thanks.

I guess now we need to ask ourselves why does generic_send_tcp misbehave?

Improve this answer
0
0

I had a hard time understanding the question, but I can suggest a tutorial on fuzzing a FTP server using SPIKE and another tutorial on SPIKE.

When debugging your SPIKE script, I think you may find it useful to start up Wireshark (or some other packet sniffer), run the SPIKE fuzzer, look at what traffic is being sent by the SPIKE fuzzer to the FTP server, and see if it's what you wanted.

Improve this answer
1
  • That's what I'm doing. I used the attached script in the command line: "generic_send_tcp 10.1.1.169 21 ftp.spk 0 0" and the first attached picture shows what I'm getting when sniffed with wireshark. And the other two pictures show what I should have gotten - I've sniffed those two packets when connecting to a ftp server manually. And of course I've read both of the tutorials you mentioned. So the question remains.
    – eleanor
    Commented Apr 14, 2012 at 10:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .