Subject: PORT short sum.

From: Alain Magloire <[email-masked]>
Date: Tue, 16 Dec 1997 13:13:28 -0500 (EST)

Bonjour

  I've posted this a few years (?) back on this list. Fortunately
I was able to retrieve it from the archives. Maybe it can help
having a better grasp at the FTP bounce problem.

Unfortunately I'm not on the list, traffic is too high.
Please Cc the followups... if any.

----------------------------------------------------------------------
Port
The FTP protocol opens a new port for retreiving/sending data.
The negotiation of the number of the port is done via the PORT command.

Taken from the rfc959.
 ###########################################
 DATA PORT (PORT)

  The argument is a HOST-PORT specification for the data port
  to be used in data connection.  There are defaults for both
  the user and server data ports, and under normal
  circumstances this command and its reply are not needed.  If
  this command is used, the argument is the concatenation of a
  32-bit internet host address and a 16-bit TCP port address.
  This address information is broken into 8-bit fields and the
  value of each field is transmitted as a decimal number (in
  character string representation).  The fields are separated
  by commas.  A port command would be:

     PORT h1,h2,h3,h4,p1,p2

  where h1 is the high order 8 bits of the internet host
  address.
 ###########################################

When data is to be transfer between a client and a server. The client
can specify to which port it wants the data to arrive. The client then
listen to the port number specify in the PORT command. The server makes an
active open to that port and sends the data.

Like we discuss before the host specify in the argument portion of the PORT
doesn't have to be the same IP as the client, hence open the door to
all sort of abuse. The easiest example that comes to mind is fake email.

  .....
 STOR smtp_file
 PORT a,b,c,d,0,25  # a,b,c,d --> a.b.c.d --> victim_ip
 RETR smtp_file

This sends an untracable mail to victim_ip. The logs on victim_ip will
always show that the connection was made by the FTP server. It's a good
way to pass thru firewalls.

-- 
au revoir, alain
----
Aussi haut que l'on soit assis, on n'est toujours assis que sur son cul !!!