1

This is my first time asking for some support in my case. Please forgive me, as I am still learning... The scenario is really simple:

Some device with HTTP server is being fuzzed by metasploit's module (http_get_uri_long) which requests long URIs and awaits for response. The HTTP server crashes when receiving about 1700 chars of URI, completely freezing the device until it is restarted manually by unplugging it from power socket. I have made multiple tests, and always when HTTP server receives "GET /XXXX..." (about 1700 of Xs) the device freezes which confirms the bug exists.

However, upon creating a simple PoC in Python (2.7) using socket module, I am requesting the same amount of Xs within URI, but without my goal (freezing the device). For shorter URI, normal 404 error is returned. But when requesting longer URIs, HTTP server doesn't reponse with anything. And the device is still up.

I have tried wireshark, to check if (maybe) I made something wrong within my PoC code, but the packets seems to be same.

Here is my PoC:

import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
ip = "192.168.0.11"
port = 80

s.connect((ip,port))
data = "GET /" + 'X' * 1800 + " HTTP/1.1\r\nHost: %s\r\n\r\n" % ip
print data
s.send(data)
print s.recv(4096)
s.close()

My goal is: achieve same result as MSF's HTTP URI fuzzer, means freezing up the device. The problem is I cannot reproduce the same with my python code.

Any help is greatly appreciated :)

1

Okay, I've found what caused the problem. Seems like the vulnerability I was testing is not traditional Denial of Service (like creating one HTTP packet with long string inside), but the "Resource Exhaustion". I've tweaked my code and now it is hanging the device properly.

Time to write a nice mail to device manufacturer :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.