Microsoft IIS FTP Server <= 7.0 LIST Stack Exhaustion
This module triggers Denial of Service condition in the Microsoft Internet Information Services (IIS) FTP Server 5.0 through 7.0 via a list (ls) -R command containing a wildcard. For this exploit to work in most cases, you need 1) a valid ftp account: either read-only or write-access account 2) the "FTP Publishing" must be configured as "manual" mode in startup type 3) there must be at least one directory under FTP root directory. If your provided an FTP account has write-access privilege and there is no single directory, a new directory with random name will be created prior to sending exploit payload.
Rank
- Normal
Authors
- Kingcope < >
- Myo Soe < >
Vulnerability References
- CVE-2009-2521
- BID-36273
- OSVDB-57753
- MSB-MS09-053
- https://www.microsoft.com/technet/security/Bulletin/MS09-053.mspx
- http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0040.html
Development
Similar Modules
- auxiliary/dos/windows/ftp/filezilla_admin_user
- auxiliary/dos/windows/ftp/filezilla_server_port
- auxiliary/dos/windows/ftp/guildftp_cwdlist
- auxiliary/dos/windows/ftp/iis75_ftpd_iac_bof
- auxiliary/dos/windows/ftp/solarftp_user
- auxiliary/dos/windows/ftp/titan626_site
- auxiliary/dos/windows/ftp/vicftps50_list
- auxiliary/dos/windows/ftp/winftp230_nlst
- auxiliary/dos/windows/ftp/xmeasy560_nlst
- auxiliary/dos/windows/ftp/xmeasy570_nlst
Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use auxiliary/dos/windows/ftp/iis_list_exhaustion
msf auxiliary(iis_list_exhaustion) > set RHOST [TARGET IP]
msf auxiliary(iis_list_exhaustion) > run
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use auxiliary/dos/windows/ftp/iis_list_exhaustion
msf auxiliary(iis_list_exhaustion) > set RHOST [TARGET IP]
msf auxiliary(iis_list_exhaustion) > run
Module Options
| FTPPASS | The password for the specified username (default: mozilla@example.com) |
| FTPUSER | The username to authenticate as (default: anonymous) |
| RHOST | The target address |
| RPORT | The target port (default: 21) |
| CHOST | The local client address |
| CPORT | The local client port |
| ConnectTimeout | Maximum number of seconds to establish a TCP connection |
| FTPDEBUG | Whether or not to print verbose debug statements |
| FTPTimeout | The number of seconds to wait for a reply from an FTP command |
| Proxies | Use a proxy chain |
| SSL | Negotiate SSL for outgoing connections |
| SSLVersion | Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
| TCP::max_send_size | Maxiumum tcp segment size. (0 = disable) |
| TCP::send_delay | Delays inserted before every send. (0 = disable) |