TYPSoft FTP Server 1.10 - APPE DELE Denial of Service

ExploitDBExploitDB exploitExploitEDB-10223

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script that implements a denial-of-service (DoS) exploit against TYPSoft FTP Server 1.10. It authenticates with supplied credentials, then sends APPE and DELE commands in sequence without sending file data, causing the server to crash. The script includes a loop to repeat the attack multiple times.

Backdoor review

No backdoor observed in reviewed code

The artifact is a Python proof-of-concept exploit for CVE-2009-4105, a denial-of-service vulnerability in TYPSoft FTP Server 1.10. It demonstrates how sending APPE followed by DELE in the same connection crashes the server. The code performs only the advertised FTP commands (USER, PASS, PORT, APPE, DELE) against a user-supplied target. No backdoor, reverse shell, data exfiltration, persistence mechanism, or other hidden malicious behavior is present.

ClassificationExploit
Model confidence98%
AuthenticationRequired
Languagespython
Target softwareTYPSoft FTP Server
Attack typesdenial-of-service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains executable Python code that actively sends crafted FTP commands (APPE followed by DELE) to trigger a server crash, which is the definition of an exploit. The code is not merely checking for the vulnerability; it exercises it to cause denial of service.

exploits/windows/dos/10223.txt:38-102

Requirements

  • Valid FTP credentials (username and password) for the target server.exploits/windows/dos/10223.txt:25-26
  • Network connectivity to the target FTP server on port 21.exploits/windows/dos/10223.txt:24

Observed behavior

  • Connects to the target FTP server on port 21.exploits/windows/dos/10223.txt:59-61
  • Authenticates using the provided username and password.exploits/windows/dos/10223.txt:67-71
  • Sends a PORT command to set up active mode data transfer.exploits/windows/dos/10223.txt:79
  • Sends an APPE command to append to a file.exploits/windows/dos/10223.txt:84
  • Sends a DELE command to delete the same file without sending file data between the commands.exploits/windows/dos/10223.txt:89
  • Repeats the attack sequence in a loop up to 10,000 times.exploits/windows/dos/10223.txt:57
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
sock.connect((hostname, 21))Connects to the target FTP server on port 21 using the hostname provided as a command-line argument.exploits/windows/dos/10223.txt:61
Network Connection
sock_data.bind((local,31339))Binds a local socket to port 31339 for the FTP active mode data connection, as required by the PORT command.exploits/windows/dos/10223.txt:76
Command Execution
FTP commands: USER, PASS, PORT, APPE, DELESends standard FTP commands to the target server to trigger the documented denial-of-service condition.exploits/windows/dos/10223.txt:67exploits/windows/dos/10223.txt:71exploits/windows/dos/10223.txt:79exploits/windows/dos/10223.txt:84exploits/windows/dos/10223.txt:89
Review boundaries

What the analysis did not establish

  • Only the single text file (10223.txt) was reviewed; no external dependencies or binary files were included.
  • The review does not assess whether the exploit actually works or is safe to run against a target.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1