Debugging server [proftpd]

Question

I'm trying to debug proftpd in order to understand better this exploit http://www.phrack.org/issues.html?issue=67&id=7. The vulnerable section is in mod_sql.c, I have tried to breakpoint the sql_prepare_where function (that is where the heap overflow is done) and then call the USER ... and PASS ... command but it is never triggered.

To find out why I have breakpoints all the hundreds line of mod_sql.c and then launch the program (with full debugging option), some breakpoints are triggered (sql_setuserinfo, set_sqlauthenticate, get_auth_entry...) but only at the very beginning of the launching process, then when the program goes in it main loop nothing else breakpoint related happens (while the log of proftpd mentions that the USER and PASS commands are dispatched to mod_sql.c)..

Would anyone know what I'm missing?

[ It's possible I am missing something essential of GDB, I am learning on the roll :) ]

Answer 1

Server programs often use a "separate program for each connection" method, where after successful accept, the parent forks a child to handle current connection, and goes back to accepting more connections.

I don't know for sure, but if proftpd used that model, it would explain exactly the symptoms you've described.

You can ask GDB to debug the child instead of the parent, by using (gdb) set follow-fork-mode child.