rapid7/metasploit-framework — pull request #2647 by jvennix-r7 (2013-11-17 22:30:14+00:00)
Title: Add http gzip decompression dos aux module

Adds an aux module for an old (2004) vulnerability. Generates a 10MB gzip "bomb" that decompresses to 10GB, and then hosts the file on a web server. Some clients (Firefox) allow for greater compression, controllable from the "ROUNDS" param. Eventually kills lots of browsers, and can possibly be used on web servers that process content from user-provided URLs.

I'm unsure though, should this be in aux/dos/http? The other modules in there are active stance. And is it okay to use the browser exploit mixin here?

#### Verification

1. Run the aux module

$ ./msfconsole
msf> use auxiliary/dos/http/gzip_bomb_dos
msf> run

2. Visit the URL in a browser. Watch browser resource usage spike in Task Manager/top. Most browsers (besides opera and chrome) will eventually crash from OOM. This will depend on system resources available.
3. Set CONTENT_TYPE to application/octet-stream and ROUNDS to 3, browse to the URL.
4. Verify a small (300byte) gzipped file is downloaded that expands to ~10GB
5. Set CONTENT_TYPE to text/html and ROUNDS to 3, browse to the URL in firefox
6. Verify Firefox crashes (this is a known issue in FF, bugzilla #233262)